A graphical user interface (“GUI”) allows for the creation of custom key performance indicators (“KPIs”) for real-time analysis of network telemetry events. The GUI can include options for defining variables based on event attributes. These can correspond to events that exist in input telemetry streams at a stream processor. The GUI can allow creation of a formula based on these variables. An aggregation section specifies how the output of the formula is aggregated. This can be based on group, aggregation function, and time period. A manager process causes the stream processor to apply the custom KPI definition to real-time input streams. An output KPI stream can then be routed to a destination for analysis.