1. Extracting and Pre-Processing Event Logs

Question 1

Why do we have to extract event logs?

Answer 1

• Event data is recorded as it occurs and thus never grouped into traces or event logs
• An event records multiple attributes (not just the name)

Question 2

What is an event table/ stream?

Answer 2

A raw logging format for events

Question 3

How do you show that an event e attribute a is undefined?

Answer 3

π(e,a) = ⊥

Question 4

What do we require for each event?

What do we require for each event in an event table?

What do we need (in addition) for an event log?

Answer 4

• The attribute time is defined
• e has a value for some attribute other than time (so has at least one meaningful observation)
• Event table = finite sequence of events that all have the same attribute a defined (this could be an activity name of other measurement)
• A case identifier (this is usually an entity type attribute but could technically be any attribute except time- depends on the question we want to answer)

Question 5

What is the difference between a general attribute and an event type?

Answer 5

Event types (i.e. users, orders, customers, deliveries) refer to specific/ unique entities or objects

To figure out if something is an entity type we need domain knowledge and additional context

Question 6

If we use id as a case identifier c and π_id(e) = c, how do we describe this?

Answer 6

event e is correlated to case c

Question 7

If all events correlated to a case c carry the same value v for a certain attribute x then what do we call x?

Answer 7

A case attribute of c

If that applies to every case c then x is a global case attribute

Question 8

What is a trace?

Answer 8

A sequence of events correlated to a case and ordered by time

Question 9

What is a structured event log?

What structure does it have?

Answer 9

Set of cases where each case is associated with exactly one trace with this case as a case attribute

Hierarchical structure
1. Cases
2. Case attributes as children (one of them being the trace)
3. Each event as children including their attributes (i.e. timestamp, observed activity, case identifier)

Question 10

Can cases share events?

Answer 10

No

Question 11

What is the difference between an activity and an event?

Answer 11

An event e ∈ E describes that a specific discrete ob-servation has been made (by a sensor, a system, a human observer, etc.). E.g. from an event table: it is an event that has a time: 19/12/2018 15:46, when payment was received. Handled by user System. The attribute time is thus defined and carries a value for some other attribute.

An activity is a specific action that can be executed or observed (so think it will be more generic like - making payment)

Question 12

What is an event attribute?

Answer 12

An attribute only specified for certain types of events (i.e. with a certain kind of activity) or where the value is specific to the event (i.e. not all events in the same case share the same value)

Question 13

Is an event atomic?

Answer 13

Yes, event should have single timestamp (not a start/ end timestamp)

To handle this we introduce lifecycle transitions- start/ complete (describe status of longer running activity- for example, two events with same activity name but with different lifecycle transitions- a start and end)

Question 14

What is an event classifier?

Answer 14

Function that maps each event to a value. The value of an event classifier for a specific event will be an event class. If two events have the same value then they belong to the same event class.

For example, the standard event classifier is the activity name classifier class.

We can make a simple trace from any event classifier as a sequence of the values (ignoring the missing values).

Question 15

If we want to use a particular event classifier for an analysis but an event has no value defined for that particular classifier, what should we do?

Answer 15

Omit the event from our analysis.

Question 16

What is the simple event log?

What is another way to call the simple traces in the simple event log?

Answer 16

List of all the simple traces for the selected event classifier with an annotation of the number of times that particular sequence occurs marked in the list.

Simple traces in the simple event log = trace variants

Question 17

What are the three basic pre-processing operations we might want to do on an event log?

Answer 17

1. Selection of certain cases that satisfy a particular property
2. Projection removes events that do not satisfy a particular property
3. Aggregation groups multiple subsequent events with the same property together (for example, multiple instances of Eat Food together might be reduced to one Eat Food)

Question 18

What are some potential limitations of event logs?

Answer 18

• the timestamp info is often not reliable (for example, if only recording on day level and we have three activities on same day, how do we order them? Potential solution is partial ordering)
• they can only have a single case identifier. But there are many more relations present, graph-based data structures allow us to represent these

Question 19

Can you use timestamp as a case identifier?

Answer 19

Technically yes but then have nothing to order the events with (so basically no)

Question 20

Why do we always study finite traces?

Answer 20

• We only have finite time beforehand
• Interested in the start to end dynamics

Question 21

How to build a structured event log?

Answer 21

• Group by case ID (ignoring events which have empty values in the case ID column)
• Order within case ID by timestamp
• Identify then the trace for each case ID and any global case attribute

Question 22

Why do we not record event logs directly in organisations?

Answer 22

The extra processing power required to do it in production is often not worth it (so need to extract ourselves afterwards)