1. A method comprising: determining, by a computing device, that a first event received by the computing device via an event stream causes a first pattern match candidate to be started for a pattern; computing, by the computing device, a first duration for the first pattern match candidate; determining, by the computing device, a first expiration time for the first pattern match candidate based upon a first time associated with the first event and the first duration; associating, by the computing device, the first expiration time with the first pattern match candidate; determining, by the computing device, that a second event received via the event stream causes a second pattern match candidate to be started for the pattern; computing, by the computing device, a second duration for the second pattern match candidate, the second duration being different from the first duration; determining, by the computing device, a second expiration time for the second pattern match candidate based upon a second time associated with the second event and the second duration; and associating, by the computing device, the second expiration time with the second pattern match candidate.