SIEM Log Ingestion Pipeline: Queueing & Storage-Tier Aging

Every SIEM platform is built on a queueing problem before it is a detection problem: log events stream in from hosts at some ingestion rate, a parsing/normalization stage can only drain that queue so fast, and once the buffer fills, events start getting dropped rather than analyzed. This simulator renders that pipeline in 3D — six host sources feed events into a live queue in front of a parser gate, and tuning the ingestion rate against the parser throughput shows the backlog and drop counter respond exactly as the λ vs. μ queueing model predicts. Events that clear the parser don't just disappear into a database; they fly into a hot storage zone and age through warm and cold tiers on a retention timer you control, live readouts track ingest/parse EPS, buffer backlog and drops, and a collapsible section spells out the underlying queueing and retention formulas.