Riemann

Overview

Riemann is an open-source event stream processor released in 2012, authored by Kyle Kingsbury (known for the Jepsen distributed systems consistency testing) in Clojure. Riemann's core capability is receiving, aggregating, filtering, transforming, and distributing streaming event data from diverse sources with millisecond-level latency. It positions itself as the "event routing hub" within monitoring infrastructure—receiving events from Nagios, Sensu, syslog, StatsD, and other systems, processing them, and routing them to alerting systems, time-series databases, or automated response tools.

Riemann employs a functional event stream processing model: events flow through streams where they undergo Index, Fold, Split, and other operations before output. While the Clojure DSL configuration has a steep learning curve, its expressiveness is unmatched—enabling complex correlation rules such as "escalate to Critical if the same host triggers 3 CPU alerts within 5 minutes." Riemann supports TCP, UDP, and TLS protocols for flexible integration with existing monitoring stacks.

Key Strengths

• Millisecond-Level Processing: Built on Clojure's event stream engine, end-to-end latency typically ranges from 1-10 milliseconds, and the full "event received to alert fired" cycle completes within 50ms—far faster than polling-based monitoring systems.
• Powerful Stream Processing: Supports Index (latest event state), Fold (state folding and aggregation), Split (divergent processing), and Periodic timed triggers—4 operations in total. Sliding-window event counting and rate computation enable sophisticated alert noise reduction.
• Flexible Clojure DSL Alerting: Define alert rules in Clojure rather than YAML/JSON config files, with 4 capabilities (conditional branching, pattern matching, state retention, custom functions)—far exceeding traditional monitoring alert templates in expressiveness.
• Multi-Protocol Ingestion: Accepts events via 4 protocols (TCP, UDP, TLS, WebSocket), with 5 client libraries (Java, Ruby, Python, Node.js, Go), and ingestion from syslog, StatsD, collectd, and Prometheus Alertmanager. See Prometheus + Grafana basics.

Product Ecosystem

Event Stream Engine

The core processing component. Events flow through configured stream pipelines supporting operations like where (filtering), tag (labeling), withdraw (cancellation), expire (timeout), and coalesce (merging).

Index

Maintains the latest state of all active events (like a "current alerts" list), supporting queries by host, service, tags, and other dimensions as an event state API for external systems.

Fold

State folding and aggregation over time windows, used for scenarios like "error count in the last 5 minutes" or "average response time."

Output and Routing

Processed events output via multiple channels—writing to Graphite/InfluxDB, triggering Webhooks, writing to log files, sending alert emails, or HTTP callbacks—pairing with Grafana for visualization.

Limitations

• Steep Clojure DSL Learning Curve: Configuration uses Clojure, requiring understanding of immutable data, recursion, and higher-order functions; ops teams typically need 2-4 weeks to write configuration independently.
• Very Small Community: With ~4,000+ GitHub Stars, community resources are very limited compared with mainstream monitoring solutions, with few Stack Overflow answers, plugins, or best-practice docs.
• No Built-In Visualization or Persistence: Riemann provides no web UI, dashboards, or data persistence; event visualization requires Grafana, and metric storage needs InfluxDB or Elasticsearch.
• Slow Iteration Pace: Limited core maintainers result in infrequent major releases; users increasingly rely on community-built plugins and patches.

Use Cases

• Real-Time Event Routing Hub (★★★★★): Unify alert events from multiple monitoring systems into a single routing pipeline—an "event bus" for monitoring infrastructure.
• Complex Alert Aggregation and Noise Reduction (★★★★): Advanced correlation and suppression based on time windows, event frequency, and host dependencies.
• High-Performance Event Processing (★★★★): Millisecond-latency requirements for high-frequency trading or real-time control systems.
• Clojure/Functional Programming Teams (★★★): Teams with existing Clojure expertise can fully leverage Riemann DSL's expressive power.

Pricing

FAQ

• Can Riemann work with Prometheus? Yes. Riemann can receive webhook events from Prometheus Alertmanager, process them, and route them to different alerting channels or ticketing systems as an alert event routing enhancement layer; see Prometheus + Grafana basics.
• Does Riemann require a database? Riemann maintains event state in memory (Index) and provides no built-in persistence. For long-term history, configure Output to write to InfluxDB, Elasticsearch, or Kafka; see monitoring and alerting.
• Is Riemann suitable for large-scale deployments? Riemann is designed for high throughput and low latency—a single instance handles tens of thousands of events per second. For larger scale, cluster Riemann with events sharded by key (e.g., hostname) across instances; see cloud monitoring services comparison.
• How is Riemann configuration managed? Riemann configuration is Clojure code, recommended to be version-controlled in Git, with hot-reload support (no process restart). CI/CD pipelines can run automated tests on configuration changes; see the Git workflow.