What an event log is

A process model can be discovered from surprisingly little. You need three things per row:

Column	What it means	Example
Case ID	Which thing this happened to	ORDER-10482
Activity	What happened	Check credit
Timestamp	When it happened	2026-03-14 09:12:31

That is an event log. Everything else — who did it, which department, how much it cost — is useful extra, but those three columns are the minimum from which a process can be reconstructed.

Why “case” is the word that matters

A case is one complete journey through the process: one order, one patient admission, one insurance claim, one recruitment. Choosing what a case is, is the single most consequential decision in an analysis, because it defines what “the process” means.

Take a webshop. If a case is an order, you will discover the order-to-cash process. If a case is an item, you will discover the picking and packing process instead — same raw data, different process, different conclusions. Neither is wrong; they answer different questions.

When one case ID is not enough

Real data often refuses to pick. An order contains items, items go into deliveries, deliveries generate invoices — and an event like Pack touches several at once. Forcing that into a single case ID is where a lot of process mining quietly goes wrong. That is what object-centric event data exists to solve, and Promenade supports it directly. You do not need it yet.

Timestamps decide the order, so they decide the model

The activity order in a case is the process, and the timestamps are what establish that order. Two consequences worth knowing before you are surprised by them:

• Equal timestamps produce false parallelism. If a system stamps five activities with the same date but no time, they have no order, and a miner will conclude they happen in parallel. A model full of unexpected parallel branches usually means coarse timestamps, not a chaotic process.
• Recording time is not event time. If a system writes rows nightly in a batch, every activity in a day carries roughly the same timestamp. You are then mining the batch job, not the process.

Events, traces, variants

Three words you will meet immediately:

• An event is one row: one activity happening to one case at one time.
• A trace is the sequence of activities for one case — Receive order → Check credit → Approve → Ship.
• A variant is a distinct trace shared by many cases. A log with 2,812 cases might have only 40 variants, and the top five usually cover most of the volume.

Variants are what make process mining tractable. You rarely reason about thousands of individual cases; you reason about a few dozen variants and ask why the long tail exists.

Next

You now know enough to read one. Discover your first model from the demo log.