1. A method, comprising: receiving first data from a first data source that continuously generates a first set of records with first common fields, wherein the first set of records characterize a first real-lime event, filtering the first data by selecting a first sub-set of fields of the first common fields to form first filtered data, wherein filtering the first data includes accessing in dynamic memory the first data stored as in-flight data; receiving second data from a second data source that continuously generates a second set of records with second common fields, wherein the second set of records characterize a second real-time event different than the first real-time event, filtering the second data by selecting a second sub-set of fields of the second common fields to form second filtered data, wherein filtering the second data includes accessing in dynamic memory the second data stored as in-flight data, wherein the first filtered data and the second filtered data are generated simultaneously by separate nodes in a network and reside in dynamic memory as in-flight data; applying rules to the first filtered data and the second filtered data at the separate nodes in the network in real-time to identify selected real-time events stored in dynamic memory as in-flight data; and reporting the selected real-time events prior to persistently storing the first filtered data, the second filtered data and the selected real-time events.