At block 408, the compute engine 102 can determine if a composition operation 302 applies to event data 122 in the event stream. As discussed above with respect to FIG. 3, the compute engine 102 may have criteria indicating when a composition operation 302 applies to event data 122. For example, the criteria may indicate that the composition operation 302 applies when event data 122 associated with a child process of a certain parent process is received, and/or that the composition operation 302 expects first event data 12 of a child process of the parent process to be received followed by second event data 122 of a child process of the parent process. If a composition operation 302 is found to apply to event data 122 at block 408, the compute engine 102 can move to block 410.
At block 410, the compute engine 102 can determine if a rally point 306 has been generated in association with the event data 122. If no rally point 306 has yet been generated in association with the event data 122, for example if the event data 122 is the first event data 122A as shown in FIG. 3, the compute engine 102 can create a rally point 306 at block 412 to store at least some portion of the event data 122, and the compute engine 102 can return to processing the event stream at block 402.