1. A computer implemented system for correlating events within a data stream, comprising: an input for receiving the data stream; and a processor comprising machine executable instructions stored on machine executable media, the instructions providing a correlation engine comprising at least one set of rules, the rules comprising event selectors having logical expressions corresponding to a plurality of attributes for the events within the data stream; the engine also comprising a decision tree built by the engine using an offline analysis of rule predicates for providing an index of the rules, wherein the engine references the decision tree to access selected rules corresponding to the events and applies the selected rules to correlate the events, wherein the rules are selected to provide a balance in performance determined according to selected attributes from the plurality of attributes; and an output for providing correlated events to a user.