some notes on supporting higher level events from log parsing