Event logs, discovery algorithms, and the three core pillars of process mining.
Process mining is a discipline positioned at the intersection of data science and business process management. It aims to discover, monitor, and improve real processes by extracting knowledge from event logs readily available in modern information systems (Van der Aalst, 2016). Unlike traditional model-driven approaches that assume processes operate as designed, process mining is data-driven — it starts from actual execution data and works backward to reveal how processes truly behave.
The field emerged from the recognition that what people think happens in a process and what actually happens can diverge dramatically. Manual process maps become outdated quickly, and self-reported workflows omit exceptions, workarounds, and shortcuts. Process mining addresses this by using algorithms to construct process models directly from timestamped event data, producing an objective, evidence-based view of operations.
Every process mining analysis begins with an event log. An event log is a collection of events, where each event refers to a specific process instance (a "case"), an activity, a timestamp, and optionally other attributes such as resource, cost, or outcome. For example, in an order-to-cash process, a single order (case) might generate events including "Create Order", "Check Credit", "Confirm Shipping", and "Send Invoice", each with a precise timestamp.
The IEEE Task Force on Process Mining standardised the XES (eXtensible Event Stream) format in 2011 to provide a common interchange format for event log data (IEEE Task Force, 2011). XES is XML-based and supports extensible attributes, making it possible to represent logs from any domain — from healthcare to manufacturing to financial services. Tools like Celonis, ProM, Disco, and PM4Py all ingest XES files, enabling interoperability across the process mining ecosystem.
The Alpha Miner, introduced by Van der Aalst et al., was the first process discovery algorithm capable of learning Petri nets from event logs. It works by analysing the ordering relations between activities — which activities follow which, which are concurrent, which are in conflict — and constructing a Petri net that captures the observed behaviour. However, the Alpha Miner struggles with noise and infrequent behaviour, producing "spaghetti models" when applied to real-world logs that contain exceptions.
The Heuristics Miner improves on the Alpha Miner by incorporating frequency information. Instead of treating every observed ordering as significant, it uses a dependency measure that weights relations by how often they occur. This makes it robust to noise and capable of producing understandable "net" models even from messy real-world data (Weijters & Van der Aalst, 2006). The Heuristics Miner remains one of the most widely used discovery algorithms in practice because it balances accuracy with interpretability.
Process mining encompasses three broad types. Discovery produces a model from event data. Conformance checking compares an existing model (e.g., a documented procedure) against the real event log to measure deviations — answering questions like "Are we following the process we designed?" and "Where do violations occur?" Enhancement extends or improves a process model using event data, for instance by adding performance indicators such as bottleneck times, rework loops, or automation opportunities.
Think of a process you interact with regularly — for example, submitting an expense report, onboarding to a new software platform, or ordering equipment through a procurement system.
Write down: (1) what steps you expect to happen, (2) what steps you actually experienced, and (3) where you think the expected and actual paths diverged. How might an event log capture this divergence? What would a discovery algorithm reveal about the real process?