I have a Kafka topic where I expect messages with two different key types: old and new.
i.e. \"1-new\", \"1-old\", \"2-new\", \"
If I understand your question correctly you only want to report id's as suspicious when there is an "old" without a corresponding "new" within the 2-minute window.
If that's the case you'll want to use a left join :
val leftJoined = oldStream.leftJoin(newStream,...).filter(condition where value expected from "new" stream is null);
HTH