A method for detecting anomalies in data streams, the method comprising: receiving instructions of a data stream language program, comprising: a threshold block configured to receive a first input and a second input, wherein the threshold block is a computation block coded in a data stream language, wherein the threshold block allows comparison of data of a set of data streams to be compared against threshold values; a first set of instructions for generating the first input of the threshold block; and a second set of instructions for generating the second input of the threshold block; receiving an input set of data streams; and executing the first set of instructions to group data of the input set of data streams according to a first set of metadata attributes associated with the input set of data streams to generate a first plurality of data streams comprising grouped data values of the input set of data streams; executing the second set of instructions to group data of the input set of data streams according to a second set of metadata attributes associated with the input set of data streams to generate a second plurality of data streams comprising threshold values, the threshold values dynamically calculated based on the grouped data according to data stream language program instructions, wherein the second set of metadata attributes is a subset of the first set of metadata attributes; providing the first plurality of data streams as the first input to the threshold block; providing the second plurality of data streams as the second input to the threshold block; matching, by the threshold block, data streams from the first plurality with data streams from the second plurality to identify corresponding data streams based on the first set of metadata attributes and the second set of metadata attributes; and for each data stream of the first plurality of data streams: comparing, by the threshold block, a data value of the data stream against a threshold value from a corresponding data stream from the second plurality; and determining, by the threshold block. whether to generate an event based on the result of comparison of the data value and the threshold value, wherein the event is reported as an anomaly detected in the input set of data streams. receiving instructions of a data stream language program, comprising: a threshold block configured to receive a first input and a second input, wherein the threshold block is a computation block coded in a data stream language, wherein the threshold block allows comparison of data of a set of data streams to be compared against threshold values; a first set of instructions for generating the first input of the threshold block; and a second set of instructions for generating the second input of the threshold block; a threshold block configured to receive a first input and a second input, wherein the threshold block is a computation block coded in a data stream language, wherein the threshold block allows comparison of data of a set of data streams to be compared against threshold values; a first set of instructions for generating the first input of the threshold block; and a second set of instructions for generating the second input of the threshold block; receiving an input set of data streams; and executing the first set of instructions to group data of the input set of data streams according to a first set of metadata attributes associated with the input set of data streams to generate a first plurality of data streams comprising grouped data values of the input set of data streams; executing the second set of instructions to group data of the input set of data streams according to a second set of metadata attributes associated with the input set of data streams to generate a second plurality of data streams comprising threshold values, the threshold values dynamically calculated based on the grouped data according to data stream language program instructions, wherein the second set of metadata attributes is a subset of the first set of metadata attributes; providing the first plurality of data streams as the first input to the threshold block; providing the second plurality of data streams as the second input to the threshold block; matching, by the threshold block, data streams from the first plurality with data streams from the second plurality to identify corresponding data streams based on the first set of metadata attributes and the second set of metadata attributes; and for each data stream of the first plurality of data streams: comparing, by the threshold block, a data value of the data stream against a threshold value from a corresponding data stream from the second plurality; and determining, by the threshold block. whether to generate an event based on the result of comparison of the data value and the threshold value, wherein the event is reported as an anomaly detected in the input set of data streams. comparing, by the threshold block, a data value of the data stream against a threshold value from a corresponding data stream from the second plurality; and determining, by the threshold block. whether to generate an event based on the result of comparison of the data value and the threshold value, wherein the event is reported as an anomaly detected in the input set of data streams.