A method for managing log messages in a system includes identifying a log message having a data value, filtering a first data value from a historical log record for a first interval, predicting whether any particular system events should occur when the first data value is filtered from a received log record and identifying the corresponding system events, initiating a second interval while filtering the first data value from a received log record, determining whether any non-predicted system events have occurred, and removing the filter for the first data value responsive to determining that a non-predicted system event has occurred.