Systems and methods for data ingestion in real time are described herein. In an embodiment, a server computer receives a message comprising one or more client events from a storage device which publishes the message in response to storing the one or more client events. The server computer stores the one or more client events as raw event strings which are then parsed into parsed event strings. Identity resolution methods are performed on the parsed event strings. Feature groups are then identified in the parsed event strings and used to generate aggregation keys which are used to aggregate the feature groups prior to storing aggregated data in one or more aggregation tables.