The system utilizes (gets) training data that comprises a plurality of training documents. Each of the plurality of training documents comprises a training token(s). The plurality of training documents are clustered into a plurality of clusters based on at least one training token in the plurality of training documents. Each cluster contains at least one training document. A Boolean query(s) is generated for a cluster based on an occurrence of the at least one training token in a training document in the plurality of training documents. The system gets production data that comprises a plurality of production documents. Each of the plurality of production documents comprises a production token(s). The Boolean query(s) is then executed on the production data.