filter logs to arff