# Event Log Preprocessing for Process Mining: A Review
## 3 Research Methodology
### C3. Representation Schemes of Event Logs Used in Preprocessing Techniques  
What structures are more appropriate to represent and manipulate event logs in preprocessing techniques? For years, the representation of information has been a basic need, almost in every domain, including process mining. Even though the total amount of storage space is not an important issue nowadays, since external memory (i.e., disk) can store huge amounts \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Features** & **From 6.5.1** & **Apromore** & **RapidProM** & **Disco** & **Celonis** \\ \hline Trace/event Filtering & Yes & Yes & Yes & Yes & Yes \\ Trace clustering & Yes & Yes & Yes & No & Yes \\ Timestamp repair & Yes & Yes & Yes & Yes & No \\ Remove attributes, events or activities & Yes & Yes & Yes & Yes & No \\ Embedded preprocessing & Yes & No & Yes & No & No \\ Abstraction & Yes & No & No & No & No \\ Alignment & Yes & Yes & Yes & No & No \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of popular process mining tools incorporating event log preprocessing techniques. of events, and is very cheap, the time required to access the event logs is an important bottleneck in many algorithms. An appropriate structure or representation scheme of the event logs will provide efficient management of large event logs supporting algorithms that process the events directly from the representation. One of the most common event log representations used in the preprocessing techniques is the vector space model (or bag-of-events) [43], where each trace is represented as a vector and each dimension corresponds to an event type. In this type of representation, the similarity between traces is measured using typical measures, such as Euclidean distance or Cosine similarity. Some proposed approaches for event log preprocessing use traces or event sequences as data structures for representation and manipulation of event logs, since they are simpler to filter, aggregate, or remove new events or traces on this structure. However, other structures, such as automatons, directed graphs, trace arrays, among others, have also been studied. In [93], a graph repairing approach for detecting unsound structure, and repairing inconsistent event name is proposed. This approach repairs event data with inconsistent labeling but sound structure, using the minimum change principle to preserve the original information as much as possible. Then, an algorithm conducts the detection and repairing of dirty event data simultaneously, so that it either reports unsound structure or gives the minimum separation of inconsistent event names. Moreover, an approximation algorithm, called PTIME, is presented in [93] to repair one transition at a time, which is repeatedly invoked until all violations are eliminated or no repairing can be further conducted. [PERSON] and [PERSON] [94] present an approach comprising four preprocessing steps for the reconstruction of process instance graphs to event log with a sequentially ordered list of activities by adding a directed sequence flow between activities of instance graphs. In this approach, instance graphs can be decomposed into independent parts, which can be mapped into a sequential event log. The first step is to mine the source data with the financial process mining (FPM) algorithm to obtain process instances represented as graphs. The second step consists of transforming these graphs to directed activity graphs. The third step is to enumerate all possible paths representing sub-sequences of the mined process instances. Finally, the fourth step is to store all paths in an event log representing the logical order of events. According to the surveyed works, the most appropriate structure to represent, manipulate, and transform raw event logs is the traces or events sequence, which can be described as a vector of values whose implementation and use is simple.