Abstract: Methods and systems of using an approximate duplicate event filter are disclosed. Event processing systems of a service provider network such as a security service may receive a large volume of events to analyze. Events that have previously occurred can be given a lower priority for analysis than new events. Events that are similar to previous events can likely also be given a lower priority for analysis. These non-exact match events can be detected by comparing token representations of new events to token representations of previous events. Events may be considered according to the context in which the events occur.