# Event Log Preprocessing for Process Mining: A Review
## 2 Preliminary Concepts  
Process mining algorithms act over an event log--an event collection containing historical records from each business process instance. Each event produced during the execution of a business process instance (a case) corresponds to a trace. The set of all traces conform to the event log. This section presents some useful concepts for understanding the basis of event log preprocessing in the context of process mining.  
**Definition 1**.: _An event refers to a case, an activity, and a point in time. The event is characterized by a set of attributes such as, ID, timestamp, cost, resource, among others [8]._  
**Definition 2**.: _A trace can be seen as a case, i.e., a finite sequence of events \(\sigma\in E^{*}\), such that each event appears only once [8]._  
**Definition 3**.: _An event log consists of a set of cases, and cases consist of events, such that each event appears, at most, once in the entire log [8]._  
The events for a case are represented in the form of a trace, i.e., a sequence of unique events. Moreover, cases, such as events, can have attributes. The structure of an event log is made up of the following elements:  
* An event log consists of cases.
* A case consists of events, such that each event relates to precisely one case.  
* Events within a case are ordered.
* Events can have attributes. Examples of typical attributes are: activity name, time, costs, and resource.  
**Definition 4**.: _A Business process model is the graphical and analytic representation used to capture the behavior of an organization's business processes._  
_A business process model is usually expressed through different graphic methods or notation languages, such as the flowchart, UML, workflows, Petri nets, BPMN, among others._  
In the context of event log preprocessing, it is essential to identify the issues closely related to the quality of the data recorded in the event log. Therefore, some of the data quality issues that commonly occur in event logs are described below.  
Noise/anomalous data: this problem corresponds to the scenario where the data in the event log contain errors, or meaningless data that deviate from the expected behavior. Incorrect or noise data may be the result from inconsistency or discrepancy in naming conventions or data codes used, or inconsistent formats for input fields, such as timestamps. Hence it is necessary to use some techniques to eliminate or replace the noisy data.  
Missing data: this problem can occur when different information can be missing in the event log, although it should be registered on a mandatory basis. This occurs, for example, when an attribute in an event is missing due to problems related to the sending, registration, or storage of events from an information system.  
Irrelevant data: in this scenario, there may be event records that are irrelevant for the analysis of the model under study, but from these, it is possible to derive the record of a relevant event through some transformation and filtering processes.  
Duplicated data: this problem is present when the same event is recorded in the event log more than once, by the same resource and with the same timestamp. Likewise, the problem may arise when an activity is registered more than once by the information system, sometimes causing the process model to become a complex model.  
Data diversity: this situation is present when the information system is very general and allows the diverse registration of events at different levels of granularity, which makes process models incomprehensible and difficult to represent.  
Many of the issues of data quality previously mentioned have been addressed in the surveyed preprocessing techniques in this work.