Riemann is a network event stream processing system that ingests metrics and events from distributed systems and processes them through a flexible pipeline of rules and transformations.
Riemann solves the problem of aggregating and reacting to high-volume event streams from infrastructure and applications in real time. It listens for incoming events over the network, applies user-defined functions to filter, aggregate, and correlate them, and can trigger actions like alerts or state transitions based on patterns detected in the stream. The system is built in Clojure and exposes a Clojure-based configuration language, allowing operators to write arbitrary logic for event processing without leaving the configuration file.
Riemann suits teams running distributed systems who need to correlate metrics and logs across many hosts and services. It works well for scenarios where you need custom aggregation logic, complex alerting rules that depend on relationships between events, or real-time stream processing that goes beyond what standard time-series databases provide. The tool is particularly valuable when you want to avoid shipping all raw events to a central store and instead process them at ingestion time, reducing storage and query load. It fits best in environments where operators are comfortable with Clojure or willing to learn it, since the configuration language requires writing code rather than declarative YAML or JSON.
The project shows consistent maintenance with regular commits addressing bug fixes and feature requests. Pull requests receive thoughtful review and discussion before merging. The maintainers respond to issues and engage with the community on questions about usage and architecture. Documentation is actively maintained alongside code changes. The project accepts contributions from external developers and integrates them into releases.
