A log event cluster analytics management method may involve storing a first portion of an entire cluster dictionary in a transient memory, storing at least a second portion of the entire cluster dictionary in a persistent database and comparing a new log event message to the first portion of the overall cluster dictionary. In response to not assigning the new log event message to any cluster in the first portion of the entire cluster dictionary in the transient memory, selecting a subset of clusters of the at least second portion of the cluster dictionary in the persistent database, comparing the new log event message to a cluster of the selected subset of clusters and assigning the new log event message to the cluster of the selected subset of clusters based upon the comparison.