Threshold and ewma inspect only not expired events