1. A method comprising: receiving an original rule configured to be used by an event based analysis engine, the original rule requiring data to be collected over a period of time; determining if the period of time is greater than a time period threshold; determining if the original rule includes an aggregate function; generating an aggregation rule that aggregates the data to be collected by the original rule if the original rule includes an aggregate function and if the period of time is greater than the time period threshold; aggregating data according to the aggregation rule; and determining if a size of data to be collected over the period of time is greater than a size threshold comprises evaluating metadata of events associated with the original rule, wherein generating the aggregation rule comprises generating an aggregation rule that aggregates the data to be collected by the original rule if the original rule includes an aggregate function, if the period of time is greater than the time period threshold and if the size of the data to be collected over the period of time is greater than a size threshold.