Event-Log Structure

• Event-Log Structure is defined as a systematic record of time-stamped events with contextual attributes that enable detailed behavioral analysis.
• It encompasses classical, object-centric, and graph-based models that support process mining, runtime verification, and auditability.
• Extraction and transformation pipelines convert heterogeneous data into normalized, referentially complete logs for rigorous quantitative analysis.

An event log is a structured record of temporally ordered events, each reflecting an occurrence of a process activity or system state change, captured with contextual and attribute information. Event logs are foundational artifacts in process mining, system monitoring, and runtime verification. Their structure determines the quality and scope of behavioral analysis, enabling both classical entity-centric and more recent object-centric, multi-entity, and graph-based process discovery paradigms.

1. Formal Models and Representations

Event-logs can be rigorously defined as sequences or collections of event records, parameterized by attribute mappings, case relationships, and in advanced settings, multi-object and relational constructs.

Classical Event Logs

Let $\mathcal{E}$ be the universe of events, $\mathrm{AN}$ a set of attribute names, and $\mathrm{Val}$ the set of values. Each event $e \in \mathcal{E}$ is a partial mapping $$\pi: \mathcal{E}\times \mathrm{AN} \rightharpoonup \mathrm{Val}$$. It is required that $\pi_{\text{time}}(e) \neq \perp$ and (at least) one other attribute is meaningful for each event. An event log is a finite, time-ordered sequence $L = \langle e_1, ..., e_n \rangle$ where $e_i.\text{time} \le e_{i+1}.\text{time}$ (Fahland, 2022).

Event logs are often hierarchically organized (as in XES and JXES (Narayana et al., 2020)):

• Log: The root collection, with optional global attributes.
• Trace: Represents a case or process instance (sequence of events sharing a case identifier).
• Event: The atomic record, at minimum containing "concept:name" (activity label) and "time:timestamp".

Object-Centric Event Logs

To address multi-object interactions, the OCEL (Object-Centric Event Log) model generalizes event logs as tuples

$$L_{\mathrm{OCEL}} = (E, OT, O, \tau, \lambda, A_E, A_O, \alpha_E, \alpha_O),$$

where $E$ is the set of events, $\mathrm{AN}$0 the set of objects, $\mathrm{AN}$1 the object types, $\mathrm{AN}$2 the type map, and $\mathrm{AN}$3 the event-object associations. Attribute sets and value mappings support both static and, in enhanced formalisms (e.g. DOCEL), dynamic (mutable, time-varying) attributes attached to both events and objects (Goossens et al., 2022, Wei et al., 2024).

Event Logs as Graphs

A further abstraction represents the event log as a labeled property graph (LPG), $\mathrm{AN}$4, with nodes partitioned into Event, Entity, Log, and Class; edges encode correlations (event-entity), process flows, and observed class aggregations (Esser et al., 2020).

Agentic/Appended Event Logs

Agentic systems such as ActiveGraph introduce a strictly append-only, typed-event log where each event is a 6-tuple $\mathrm{AN}$5, supporting determinism, auditability, lineage, and dynamic graph projection via deterministic log folding (Nakajima, 21 May 2026).

2. Core Structural Elements

Key elements and fields that constitute event-log structure include:

Element	Role/Definition	Examples from Standards/Models
Event	Atomic record; carries timestamp, activity, attributes	$\mathrm{AN}$6
Trace (Case)	Sequence of events of a process instance	List of events sharing $\mathrm{AN}$7
Object	Real-world artifact or entity involved in events	OCEL: Order, Invoice, Resource
Attribute	Key-value pairs on event, trace or object level	"amount":120, "org:resource":"Alice"
Relation	Links between objects or between events and objects	OCEL Relations(source, target, ts, qual)

Every event carries at least an activity and timestamp; in object-centric or graph-based representations, additional explicit links to objects and dynamic attribute tables are present. Constraints such as uniqueness of identifiers, referential integrity, and normalization (often 3rd-NF) are critical in high-fidelity formats (Wei et al., 2024, Goossens et al., 2022).

3. Extraction and Transformation Pipelines

Event-log structure is typically synthesized via extraction, transformation, and loading pipelines, which materialize logs from heterogeneous operational or sensor data sources.

Extraction

Raw event tables (e.g. SQL, CSV) are processed as finite sequences of attribute-mapped records. A case identifier attribute (id) is chosen to define cases: $\mathrm{AN}$8 and event-case correlation sets are constructed accordingly (Fahland, 2022).

Object-Centric Construction

For object-centric logs, extraction traverses source-system schemas (e.g. SAP ERP, Graph-of-Relations), projects entities as object collections, and builds event-object mappings by analyzing foreign-key and transaction tables (Berti et al., 2021). Extraction algorithms (e.g. Dirigo (Wei et al., 2024)) follow formal ORM-modeled steps: define business scope, activities/resources, object sets and attributes (static and dynamic), map event-object and object-object relations, and enforce schema normalization and completeness.

Abstraction and Integration

For IoT event data, event abstraction maps streams of raw sensor states to semantically-labeled events via learned or LLM-driven functions: $\mathrm{AN}$9 followed by merging and sorting across modalities to produce a unified event log suitable for high-level behavioral mining (Shirali et al., 2024).

4. Advanced Structural Features and Meta-Analysis

Event-log structure extends beyond schema by considering statistically derived structural features ("meta-features") that impact downstream mining algorithms. Examples include activity frequency quantiles, entropy of activity subsequences, variant skewness, and trace-length moments (Maldonado et al., 10 Sep 2025). Their presence or absence modulates algorithmic behavior such as fitness, precision, model complexity, and runtime.

Machine learning applications derive structural feature vectors from event logs:

• Activity-counts
• 2-gram transitions (directly-follows)
• General orderings (e.g. $\mathrm{Val}$0: activity $\mathrm{Val}$1 before $\mathrm{Val}$2 anywhere in trace)

Feature selection techniques (clustering, LASSO, mRMR) enable tractable classification or root cause analysis when event logs have high feature dimensionality (Hinkka et al., 2017).

5. Multi-Entity and Relational Structures

Data models have evolved to encode multi-entity interactions, asynchronous process flows, and composite relation artifacts:

• Object-centric models: Event-object assignment maps, dynamic object attributes, temporal object-relations (static vs. dynamic) (Wei et al., 2024, Goossens et al., 2022).
• Graph/LPG models: Explicit nodes for both events and entities, correlated via labeled edges. Composite nodes (e.g., for synchronous/asynchronous relations) are constructed by reification, supporting sophisticated temporal and structural queries (Esser et al., 2020).
• End-to-end lineage: In agentic and data versioning contexts, each artifact, action, or edge in the graph is traced back via causality chains encoded in the log (provenance blocks, causedBy pointers), supporting full auditability (Nakajima, 21 May 2026).

6. Standards, Interchange Formats, and Queryability

Event-log structures have standardized formats to support interoperability and tool chain integration:

• XES/JXES (IEEE 1849): XML or JSON hierarchical representation with log, trace, and event levels, classifiers, extensions, and global attribute schemas (Narayana et al., 2020).
• OCEL/OCED: Relational schema with Events, Objects, ObjectChanges (tracking both static and dynamic attributes), and Relations tables (Wei et al., 2024).
• DOCEL: Explicit representation of static/dynamic attributes and unambiguous event-object linking (Goossens et al., 2022).
• Property Graph Models: Fully graphized encoding for multi-entity and multi-perspective querying (Esser et al., 2020).

Queryability is supported through attribute-based slicing, entity- and event-centric traversals, path and pattern queries, and aggregation at both event and multi-entity levels, often using languages such as Cypher for LPG-based logs.

---

In summary, event-log structure encompasses rigorous models and extraction pipelines that transform semi-structured or raw system data into normalized, attribute-rich, and referentially complete records supporting both classical and advanced process mining. The choice of log structure—classical, object-centric, graph-based, or agentic—directly impacts the kinds of behavioral, organizational, and provenance analyses that can be performed, as well as the robustness and interpretability of resulting process models (Fahland, 2022, Wei et al., 2024, Goossens et al., 2022, Berti et al., 2021, Esser et al., 2020, Narayana et al., 2020, Nakajima, 21 May 2026).