1. A master node in a distributed event correlation system including cluster nodes in a cluster, the master node comprising: at least one processor to: divide an event field in events into partitions including ordered contiguous blocks of values for the event field; assign each partition to a pair of the cluster nodes; determine a partition map from the partitions, wherein the partition map identifies for each partition, the block of the event field values for the partition, a primary cluster node, and a failover cluster node for the primary cluster node; and a data storage to store the partition map, wherein the at least one processor is to store the partition map in the data storage.