Unified Observability · Interactive Simulation

One pipeline for every
log, metric, event, and trace.

NimbusPulse ingests data from AWS, Azure, GCP, Kubernetes, system logs, security tools, databases, and custom sources — through declarative connectors defined in JSON or YAML. Every button, modal, chart, and the AI assistant below is fully interactive on static data + localStorage.

22
Source connectors
5
Ingest protocols
JSON
Schema format
YAML
Schema format
§ 01 — System Overview

How data moves through NimbusPulse

Five logical stages. Sources push, or are pulled by connectors, normalized into a common event schema, enriched, then routed to storage and the dashboard. Every stage is horizontally scalable.

01 · SOURCES AWS CloudWatch Azure Monitor GCP Logging Kubernetes Syslog / RFC 5424 Security / SIEM Custom · Webhook 02 · INGEST REST · /v1/ingest gRPC stream GraphQL sub. WebSocket Kafka topic Pull · cron 03 · NORMALIZE Schema map connector.yaml Enrich geo · user · trace Filter / Mask PII redaction Route topic.events.* 04 · STORE Elasticsearch ClickHouse · OLAP S3 · cold storage Redis · hot cache TimescaleDB 05 · CONSUME Dashboards live tiles Alerts PagerDuty · Slack AI Assistant LLM · RAG Search / Export REST · CSV · API
§ 02 — Live Dashboard

Real-time signals from every source

Tiles update every 2 seconds from the in-memory event simulator. Click any tile to see what the metric measures and how it's computed.

Throughput · last 60 ticks
Events per second across all sources
By severity
Last 5 minutes
§ 03 — Source Connectors

22 built-in connectors, plus your own

Each connector is a declarative spec: protocol, endpoint, auth, schedule, and field schema. Toggle a connector to start or stop ingestion. Custom connectors you add are saved to localStorage and appear below alongside the built-ins.

Add a custom connector

Paste a JSON or YAML schema below. It will be validated, saved, and appear in the grid above.

connector.spec JSON
Validation
Awaiting input…
§ 04 — Live Event Stream

Every event, as it arrives

A continuous feed of normalized events. Click any row to see the raw payload, run an explanation, or take action (acknowledge, mute, investigate, replay).

Time
Sev
Source
Message
§ 05 — Logs Explorer

Search & drill into raw log lines

Use the search to filter by message text, source, or severity. Click a row to see structured fields, the original raw line, and an AI explanation of what likely happened.

§ 06 — Ingestion Protocols

Pick the right wire format per source

Different sources speak different protocols. The platform exposes five gateways; connectors pick whichever fits the source. Below is each protocol with a flow example.

REST
POST /v1/ingest
Push, batched. Best for periodic exports, webhook receivers, low-volume agents.
ClientGatewayPOST JSON200 OK
gRPC
Stream RPC
Bidirectional, binary, schema-strict. Best for high-volume agents (k8s, edge).
AgentgRPC svcprotobufack
GraphQL
Subscriptions
Selective field subscriptions. Best for UIs that need a focused live feed.
UIGQLsubscribeevents…
WebSocket
wss://ingest
Persistent duplex. Best for browser apps, IoT, and bidirectional control.
BrowserWS svcopen framemessages
Kafka
topic.ingest
Durable log-based queue. Best for backpressure, replay, multi-consumer fanout.
ProducerKafkaConsumer
§ 07 — Production Architecture · Target State

What we'd actually build, behind this UI

The simulation above is the front-end of the system. Below is the production reference architecture this UI is designed against: Apache NiFi as the dataflow orchestrator, Kafka as the durable bus, Flink for stream processing, and a polyglot storage layer feeding the dashboard, alerts, and AI assistant.

SOURCES INGEST GATEWAYS DATAFLOW · APACHE NiFi STREAM BUS & PROCESS STORAGE AWS CloudWatch / S3 Azure Monitor / Event Hub GCP Logging / Pub/Sub Kubernetes (Fluent Bit) Syslog / RFC 5424 Security tools / SIEM IoT / Edge devices DB CDC (Debezium) Custom apps / Webhooks REST GatewayNginx · OpenAPI gRPC ServiceEnvoy · protobuf GraphQL GatewayApollo · subscriptions WebSocket Hubsocket.io · sticky Kafka Connectsource connectors Pull Schedulercron · cloud APIs Apache NiFi dataflow orchestration ListenHTTP / ListenTCP receive from gateways EvaluateJsonPath · Schema parse + validate against registry UpdateAttribute · Enrich geo · user · trace id ReplaceText · PII mask regex redaction · tokenize RouteOnAttribute split by severity / domain PublishKafkaRecord_2_6 topic.events.{severity} Apache Kafka events · metrics · audit Schema Registry Confluent · Avro/Proto Apache Flink windowed aggregations Anomaly Detector ML scoring · z-score Alert Engine rules · PagerDuty · Slack Elasticsearch full-text · 7-day hot ClickHouse OLAP · columnar S3 + Iceberg cold · parquet · 1yr+ Redis hot cache · counters TimescaleDB metrics · time-series QUERY · API · AI Query API REST · GraphQL · DSL Auth · RBAC · Audit Keycloak · OIDC · OPA RAG · Vector Store pgvector · embeddings LLM Assistant explain · summarize · query CONSUMERS Web Dashboard React · live tiles Alerts & Paging PagerDuty · Slack · email Mobile / CLI iOS · Android · npulse CLI Downstream Apps Snowflake · BI · webhooks Compliance Export SOC2 · HIPAA · GDPR CROSS-CUTTING Observability · OTel Secrets · Vault Infra · Terraform · K8s CI/CD · GitOps · ArgoCD Cost · FinOps tags
Why Apache NiFi at the center?

NiFi gives a visual, auditable, drag-and-drop dataflow with built-in back-pressure, provenance, and 300+ processors. Connectors defined as YAML in this UI compile down to NiFi process groups. Schema validation, enrichment, masking, and routing all happen here before anything hits Kafka.

Why Kafka + Flink?

Kafka is the durable, replayable bus — every downstream system (storage, alerts, AI) is a consumer. Flink reads from Kafka to compute windowed metrics, sessions, and anomaly scores, writing results back to a metrics topic that fans out to TimescaleDB and the dashboard.

Why polyglot storage?

No single store is good at everything. Elasticsearch for fast text search, ClickHouse for analytics over billions of rows, S3 + Iceberg for cheap long-term retention with query, Redis for hot counters, TimescaleDB for metrics. The query API hides this from callers.

§ 08 — AI Assistant

Ask anything about your data

In production, this assistant runs over your indexed events using RAG (retrieval over Elasticsearch + vector store) and a guard-railed LLM. Here, it's a static pattern-matched simulation — try the suggested prompts or type your own.

NimbusPulse Assistant · simulated
RAG · LLM
§ 09 — ETL Pipeline · Simulation

Upload anything. Watch the pipeline.

Drop a file below to simulate the full Extract → Transform → Load pipeline. In production this writes to MinIO (raw + images) and Elasticsearch (searchable text), and emits a Kafka event for each stage. Here, everything stays in your browser — fake extraction, plausible metadata, persisted to localStorage.

Step 1 · Pick a file

Library · processed documents

Click any card to see extracted text + images. Persists in localStorage.