For most of analytics history, "real-time" was an aspirational term that meant "less than 15 minutes old." Today, genuine sub-second analytics is achievable by teams of any size, at a cost that fits within a reasonable engineering budget. But building it well requires understanding the architecture, the tradeoffs, and when you actually need real-time vs. when near-real-time is fine.
This guide walks through the components of a modern real-time analytics stack, the tooling landscape, and a practical framework for deciding what to build vs. buy.
What is real-time analytics, really?
Before diving in, let's define terms. There's a spectrum of "freshness" in analytics:
- Batch (historical): Data refreshes once a day or once a week. Standard for most traditional BI setups.
- Near-real-time: Data refreshes every few minutes. Sufficient for most operational dashboards.
- Real-time: Data is available within seconds of an event occurring. Required for operational use cases where stale data leads to bad decisions.
- Streaming: Continuous processing of data as it arrives, often with sub-second latency.
Most businesses don't actually need true streaming for their analytics. A 2-5 minute refresh cycle covers 90% of use cases at a fraction of the complexity. The key is being intentional about which dashboards and metrics genuinely require sub-second freshness and engineering to that requirement specifically.
The core components
1. Event streaming backbone
The foundation of any real-time analytics system is an event stream — a durable, ordered log of everything that happens in your application. Apache Kafka is the industry standard here, with managed alternatives like Confluent Cloud, AWS Kinesis, and Google Pub/Sub reducing operational burden significantly.
Your application services publish events to topics (user signed up, order placed, payment processed, session started), and your analytics pipeline consumes from those topics. This decouples your application from your analytics infrastructure and enables multiple consumers with different processing requirements.
2. Stream processing
Raw event streams need to be processed — filtered, aggregated, enriched, and shaped into a form your analytics layer can query efficiently. The main tools here are Apache Flink (most powerful, most complex), Apache Spark Streaming (great if you already have Spark), and newer cloud-native options like AWS Kinesis Data Analytics and Google Dataflow.
For teams getting started, we often recommend beginning with simpler tools like dbt or even scheduled micro-batch jobs before jumping to full streaming frameworks. The operational complexity of Flink is real, and it's often not necessary.
3. OLAP storage layer
This is where processed data lands for querying. The options here have expanded dramatically. Traditional choices:
- Snowflake: Excellent for complex analytical queries, mature ecosystem, strong governance. Latency of minutes, not seconds.
- BigQuery: Serverless, scales infinitely, tight integration with GCP. Similar latency characteristics to Snowflake.
- Redshift: AWS-native, mature, predictable pricing. Good for teams already on AWS.
For genuinely sub-second query performance on freshly ingested data, you need a different class of tool:
- Apache Druid: Purpose-built for high-throughput, sub-second OLAP on streaming data. Complex to operate but very powerful.
- ClickHouse: Columnar store with exceptional query performance. Can ingest data in real-time and query it immediately. Growing rapidly in adoption.
- Apache Pinot: LinkedIn's open-source real-time OLAP system. Used at Uber, Stripe, and others at massive scale.
4. Semantic layer
A semantic layer defines your business metrics in a consistent, centralized way — so "revenue" means the same thing in every dashboard, every report, and every ad-hoc query. Tools like dbt Metrics, Cube.js, and Lookml serve this purpose.
This is often the most underinvested part of the stack, but it pays enormous dividends over time. When every metric is defined once and referenced everywhere, you eliminate the "which revenue number is correct?" conversations that plague most analytics programs.
5. Visualization layer
The dashboard and reporting layer that business users interact with. At this point, most teams should be using an off-the-shelf tool rather than building custom. The market has matured significantly. Considerations: query performance (does it push down to your data layer efficiently?), user experience for non-technical users, collaboration features, and embedding capabilities.
Architecture patterns
Lambda architecture
The original real-time analytics architecture pattern: a batch layer for historical accuracy, a speed layer for low-latency recent data, and a serving layer that merges them. This works but requires maintaining two separate pipelines for the same data, which creates operational complexity and consistency challenges.
Kappa architecture
Process everything as a stream, including historical data (reprocess from the beginning of your log). Simpler operationally, but requires your streaming system to handle both real-time and batch-scale loads. Increasingly viable as streaming systems mature.
Modern lakehouse pattern
Emerging architecture that combines a data lake's storage characteristics with a data warehouse's analytical capabilities. Table formats like Apache Iceberg and Delta Lake enable ACID transactions and schema evolution on object storage, while allowing streaming writes. This is where the industry is trending.
Build vs. buy framework
Before building any of this infrastructure, ask yourself these questions:
- What is our actual latency requirement? If 5-minute delays are acceptable, a managed ETL tool is probably sufficient.
- What is our engineering capacity and expertise? Real-time streaming systems are significantly more complex to build and operate than batch systems.
- Is this a core differentiator? If analytics infrastructure is not your core product, you're usually better served by best-in-class tools than bespoke builds.
For most companies, a managed analytics platform handles the infrastructure complexity while your engineers focus on the business logic and data quality that actually differentiate you. The total cost of ownership — including engineering time, reliability work, and ongoing maintenance — almost always favors buying over building until you're operating at significant scale.
Getting started: a practical path
If you're starting from scratch in 2025, here's the stack we'd recommend for a team of 2-10 engineers:
- Instrument your application with a structured event tracking library (Segment, Amplitude, or DIY with Kafka producers)
- Route events to a cloud data warehouse (BigQuery or Snowflake) via a managed connector (Fivetran or Airbyte)
- Define your metrics in a semantic layer using dbt metrics or Cube.js
- Connect a visualization layer — one that pushes queries down to your warehouse rather than pulling raw data
- Add streaming only for the specific metrics that require sub-minute freshness
Start simple, instrument well, and evolve the architecture as your requirements become clearer. The most expensive mistake in analytics infrastructure is over-engineering before you know what you actually need.
Skip the infrastructure complexity
Ludex handles the entire real-time ingestion and query layer so you don't have to. Connect your sources and start building dashboards in minutes. Try it free →