A distributed services platform may generate a plurality of log files containing metric values. Metric values may be provided to a first level of a topology of aggregation modules. The first level of aggregation modules may provide output to a second level of the topology. Subsequent levels of the topology may perform greater amounts of aggregation while providing stream-based access to the aggregated values. State information for the aggregation topology may be saved subsequent to each cycle of values through the topology.