# Data Preprocessing Method and API for Mining Processes from Cloud-Based Application Event Logs
## 3 Materials and Methods  
Our research method follows [PERSON]'s design science research (DSR) in information systems (IS) [7], both in terms of research relevance and research rigor. The design science paradigm is based on iterative problem solving. It aims to create innovations that define the ideas, practices, and products through the analysis, design, and implementation where the use of IS can be effectively and efficiently accomplished. In this paradigm, an artifact should be produced by taking into consideration the existing knowledge in the discipline and should be produced creatively to solve real-world problems. Artefacts are usually constructs, models, methods, and instantiations. We have instantiated DSR's five steps to our research context. **(1) Awareness of problem**: In this phase, the researcher defines the specific research problem and justifies the value of this research and the proposed solution. We performed a systematic literature review about the challenges in the area of process mining for cloud-based applications [11], whose conclusions are summarized in Section 2. Input from key informants of a SaaS application provider obtained through meetings was also taken into consideration. This also led to our main research question: What is a suitable method by which to discover and analyze cloud-based application processes? **(2) Suggestion**: In this phase, from the defined problem and knowledge of what is possible and feasible, we defined the objectives for the solution. A tentative solution was developed that was presented to a SaaS company that provided event logs from their systems. In this phase, a new method (our main artifact) and its different steps were defined, and the solution was illustrated with a manual example. This new method is the topic of Section 4. **(3) Development**: In this phase, the researcher creates an artifact, which is the solution to the defined problem. The artefact developed here is a method that exploits an API (with an implementation). The development went through several iterations by exploring available features in existing tools (mainly Disco, several ProM plug-ins, and data processing libraries) with open-source datasets and real event logs from the case study. The existing functions relevant to the preprocessing of cloud-based application logs can hence be replicated outside these tools (in the API, in order to support automation in one place, independently of the PM tools used for visualization and analysis) and supplemented by new useful functions in the API. An implementation of the API was done in the R programming language ([[https://www.r-project.org/about.html](https://www.r-project.org/about.html)]([https://www.r-project.org/about.html](https://www.r-project.org/about.html)), accessed on 13 April 2022). R was selected as this is a common data manipulation and analysis language, and it was also already used extensively by the SaaS company. This API is presented in Section 5. **(4) Evaluation**: In this step, the researcher observes and measures how well the artifacts support a solution to the problem. Additionally, the researcher communicates the problem and its importance. The evaluation method that was used here is an application case study, combined to a comparative analysis and a performance evaluation. A dataset provided by a SaaS company was used to evaluate the developed method for preprocessing event logs before importing the event logs to the PM tools. After preprocessing the event  
Figure 1: Relationship between ETL and a desirable API for preprocessing. logs by using the proposed method, the Disco and ProM PM tools were both used to build the process maps and visualize how processes are executed in reality. Several iterations are performed on the dataset in order to answer the questions about the business processes. Here, we used two iterations based on two versions of the event log (taken at different times) to assess the complexity of adapting scripts in the context where the structure of logs changes.