Query of `riemann streams rate` & instrumentation about riemann HOT 1 OPEN

IIRC (streams (where...))(streams (where...)) is equivalent to (streams (where...)(where...)).

The riemann index size is simply the number of non-expired events in the index.
From the documentation:

The index is a table of the current state of all services tracked by Riemann. Each event is uniquely indexed by its host and service. The index just keeps track of the most recent event for a given (host, service) pair.

So you're correct in your assuption that the tuple [:host :service] has a big influence on the index size, as they are the primary keys: you can index many events with the same [:host :service] and the index size will increase at most by 1.

from riemann.