I somehow missed Riemann, that looks super neat. The same stream parsing of reconnoiter but with clojure instead of esper.<p>I think I'd also want to stuff all the raw events into a log (or cassandra maybe?); going back in time with only RRD-like storage loses a lot of data.