Provided are techniques for data stream switching. While accepting data change messages from a historical data stream, in response to determining that the end of the historical data stream is approaching, consumption from a real time data stream is resumed. In accepting data change messages from one of a historical data stream and a real time data stream, a data change message identifier (DCMID) for a data change message is obtained. Then, it is determined whether the data change message is from the real time data stream. In response to determining that the data change message is from the real time data stream, the DCMID is processed against a historical data structure to determine whether the related data change message has been seen in the historical data stream. In response to determining that the data change message is from the historical data stream, the DCMID is processed against a real time data structure to determine whether the related data change message has been seen in the real time data stream. It is determined whether a threshold for a number of DCMIDs that correspond to each other in the real time data stream and the historical data stream has been met. In response to determining that the threshold has been met, there is a switch from capturing data change messages in the historical data stream to capturing data change messages in the real time data stream.