The XES standard defines a grammar for a tag-based language whose aim is to provide designers of information systems with a unified and extensible methodology for capturing systems’ behaviors by means of event logs and event streams. This standard includes a “XML Schema” describing the structure of an XES event log/stream and a “XML Schema” describing the structure of an extension of such a log/stream. Moreover, the standard includes a basic collection of so-called “XES extension” prototypes that provide semantics to certain attributes as recorded in the event log/stream.
The figure below shows the XML serialization for the XES Standard as a state machine flow diagram. The main part of the diagram is the part containing the log, the traces (a trace bundles all events related to some case), the events, and the attributes. As the diagram shows, all these elements may have any number of attributes, and an attribute can be of seven different types (six simple types and one list type).
A classifier assigns to each event an identity, which makes it comparable to others (via their assigned identity). Examples of such identities include the descriptive name of the activity the event relates to, the descriptive name of the case the event relates to, the descriptive name of the cause of the event, and the descriptive name of the resource the event relates to.
An extension defines a (possibly empty) set of attributes for every type of element. The extension provides points of reference for interpreting these attributes, and, thus, for their containing elements. Extensions therefore are primarily a vehicle for attaching semantics to a set of defined attributes per element. Extensions have many possible uses. One important use is to introduce a set of commonly understood attributes which are vital for a specific perspective or dimension of event log analysis (and which may even not have been foreseen at the time of developing this Standard).
As an example, the Concept extension stores a generally understood name for any element. For logs, the name attribute may store the name of the process having been executed. For traces, the name attribute usually stores the case ID. For events, the name attribute represents the name of the executed activity represented by the event. Other uses of extensions include the definition of generally-understood attributes for a specific application domain (for example, medical attributes for hospital processes), or for supporting special features or requirements of a specific application.
State machine flow diagram for the XES XML serialization