I read somewhere one of the earlier solutions for customer.io consisted of manual hadoop-ing. Personally I would probably use something like Storm for realtime processing based on a set of rules that would be updated every time a user adds or removes a rule (Ruby Treetop based, probably have a web front GUI for the user which then generates the DSL for rules). As well as a data store to store events tying them to userids that can be queried, Redis backed for speed perhaps.