In a distributed cloud environment, a collecting agent deployed external to a kernel of a compute host collects network data packets describing various raw events communicated between compute instances of the environment and metadata associated with the events from various sources. The collecting agent communicates the metadata to a cloud application. The collecting agent also communicates the packets to a stream processor that is decoupled from the collecting agent. The stream processor processes the packets in a stateful manner to generate a set of time series data. The time series data is communicated to the cloud application, where a set of enhanced time series data is generated by merging the time series data with the metadata in a distributed manner. A topology map describing the compute instances of the distributed cloud environment is then generated based on the set of enhanced time series data. The topology map is then displayed.