A computer-implemented method for processing event logs, comprising: obtaining one or more event logs generated by a process executing on one or more computing devices; for each event of multiple events in the one or more event logs: generating a table (202, 204) of logged event instances for the event; training a model for an autoencoder using the logged event instances for the event from multiple event logs, wherein training the model includes determining one or more key value pairs of the logged event instances to be used as features for training the model and training the model based on values of the features, and wherein determining the one or more key value pairs to be used as the features for training the model includes determining that a numeric count of distinct values for each key value pair in the logged event instances is within a threshold numeric range; identifying a logged event instance as an anomaly in the process by processing the table (202, 204) using the autoencoder, the identifying being based on a value of the features of the one or more of the logged event instances; and outputting an indication of the anomaly in the process. obtaining one or more event logs generated by a process executing on one or more computing devices; for each event of multiple events in the one or more event logs: generating a table (202, 204) of logged event instances for the event; training a model for an autoencoder using the logged event instances for the event from multiple event logs, wherein training the model includes determining one or more key value pairs of the logged event instances to be used as features for training the model and training the model based on values of the features, and wherein determining the one or more key value pairs to be used as the features for training the model includes determining that a numeric count of distinct values for each key value pair in the logged event instances is within a threshold numeric range; identifying a logged event instance as an anomaly in the process by processing the table (202, 204) using the autoencoder, the identifying being based on a value of the features of the one or more of the logged event instances; and outputting an indication of the anomaly in the process. generating a table (202, 204) of logged event instances for the event; training a model for an autoencoder using the logged event instances for the event from multiple event logs, wherein training the model includes determining one or more key value pairs of the logged event instances to be used as features for training the model and training the model based on values of the features, and wherein determining the one or more key value pairs to be used as the features for training the model includes determining that a numeric count of distinct values for each key value pair in the logged event instances is within a threshold numeric range; identifying a logged event instance as an anomaly in the process by processing the table (202, 204) using the autoencoder, the identifying being based on a value of the features of the one or more of the logged event instances; and outputting an indication of the anomaly in the process.