Event log

What is an event log?

An event log is the raw data behind process mining. It’s a detailed list of all the actions that happen in a process, recorded by the systems your business uses. Every time someone creates an order, approves an invoice, or closes a support ticket, that action is saved as an event in the system.

Each event log entry usually contains three key pieces of information:

1. Case ID – a unique identifier, like an order number or invoice ID, that ties all steps of one process together.

2. Activity name – what happened, such as “order created” or “invoice approved.”

3. Timestamp – when it happened.

With these three fields, process mining tools can rebuild the full story of each case from start to finish. They show how long each step took, who was involved, and where things might have slowed down.

You can think of an event log as the digital footprint of your business processes. Without it, process mining wouldn’t be possible.

How do you construct an event log?

You construct an event log by collecting and structuring data from the systems where your processes run. The goal is to turn raw system data into a clean table that shows what happened, when, and to which case.

Here’s how it’s usually done:

1. Identify the process
   Choose one process to analyze, like order-to-cash or purchase-to-pay. Knowing the process helps you find where the data lives.

2. Find the data sources
   Locate the systems that record the process steps, such as ERP, CRM, or ticketing tools. Each action in these systems leaves a digital trace.

3. Extract the right fields
   Pull the minimum required data:

   • Case ID (for example, Order_ID or Invoice_ID)

   • Activity name (for example, “Order created,” “Invoice approved”)

   • Timestamp (date and time of the activity)
     Add optional fields like user, department, amount, or system for deeper analysis.

4. Clean and format the data
   Make sure timestamps are in order, IDs are consistent, and activity names are clear. Every row should represent one activity in a case.

5. Load it into a process mining tool
   Tools like Power Automate, Celonis, PAFnow, or Disco can then read the event log and automatically rebuild the process flow.

You build an event log by turning system data into a structured timeline of activities. It’s the foundation for understanding how work really happens.

What are challenges creating an event log?

Creating an event log comes with several challenges. While the idea is simple, real business data rarely fits neatly into one structure.

One major challenge is complex relationships. For example, one invoice can be linked to multiple purchase orders, and the same purchase order can be linked to several invoices. This makes it difficult to decide what the main “case” should be. You have to choose whether to track the process from the point of view of the invoice, the purchase order, or create a combined case definition.

Other common challenges include:

1. Missing or inconsistent timestamps
   Some systems don’t record every event or log them late, making it hard to rebuild the correct order of activities.

2. Unclear activity names
   The same action might appear under different names in different systems or countries, requiring standardization before analysis.

3. Multiple data sources
   Processes often span several systems, such as SAP for purchasing and another platform for payments. Combining these datasets while keeping steps in the right order can be complex.

4. Data volume and quality
   Event logs can include millions of rows. Duplicates, missing IDs, or errors can easily distort the analysis.

5. Choosing the right case ID
   The case ID defines what you’re analysing. Picking the wrong one can make the process look disconnected or incomplete.

The challenge lies in turning messy, real-world data into a clean, structured timeline of events that accurately represents how work happens. There are some design choices you'll have to make when creating an event log. There is no fixed set of rules to follow. The choices you make depend on the analysis you want to do. E.g. in the cases of multiple PO's linked to multiple invoices and vice versa. Will you start from the PO to identify a case? Or will you start from the invoice? The structure of the event log will be different depending on the choice you make. So, it requires some consideration and understanding of what the end goal of the process mining analysis is. You'll have to translate that end goal into the most optimal data structure.