Analysing user event logs in real-time is pretty easy to do if you are willing to throw money at the problem. But if you want to process hundreds of millions of events with very low memory, you would want to look at probabilistic data structures.
Probabilistic Data Structures allow you to process huge volumes of data on low memory machines, while compromising on accuracy – which in some cases are a valid trade off.