1. A computer-implemented method for collecting event information, comprising: receiving events at a first plurality of nodes in a distributed system, each event having attributes; for the events received at each node of the first plurality of nodes, determining aggregated attribute information corresponding to two or more rules; at each node of the first plurality of nodes, storing the aggregated attribute information in two or more distinct first tables, each table of the first tables storing aggregated attribute information for a different respective rule of the two or more rules; at each node of the first plurality of nodes, transmitting the two or more distinct first tables to a respective node of a second set of nodes in the distributed system, the second set of nodes comprising one or more nodes in the distributed system; at each node of the second set of nodes, generating two or more distinct second tables by merging the aggregated attribute information in the tables transmitted to the node, each table of the two or more second tables corresponding to a respective rule of the two or more rules; and evaluating each rule of the two or more rules using the aggregated attribute information obtained from a corresponding table of the second tables; wherein the aggregated attribute information for a received event is stored in a row of a respective table determined by a hash function, wherein the hash function takes as input at least a portion of the aggregated attribute information for the received event.