Events from one or more primary systems associated with one or more tenants are received. The received events are stored in a message queue. At least a portion of the events in the message queue are ingested for organization and storage in a data store. One or more progress identifiers associated with ingesting of the events in the message queue are tracked. An event query is received from an external system. The event query is rewritten into a first component query for the data store and a second component query for the message queue based at least in part on a progress identifier. A result of the first component query and a result of the second component query are combined to determine a result of the event query.