The XES standard defines a grammar for a tag-based language whose aim is to provide designers of information systems with a unified and extensible methodology for capturing systems’ behaviors by means of event logs and event streams. This standard includes a “XML Schema” describing the structure of an XES event log/stream and a “XML Schema” describing the structure of an extension of such a log/stream. Moreover, the standard includes a basic collection of so-called “XES extension” prototypes that provide semantics to certain attributes as recorded in the event log/stream.

The figure  below  shows  the  XML  serialization  for the XES Standard as a state machine flow diagram. The main part of the diagram  is  the  part  containing  the  log,  the  traces (a trace bundles all events related to some  case),  the  events,  and  the  attributes.  As the diagram shows, all these elements may  have  any  number  of  attributes,  and  an  attribute  can  be  of  seven  different  types (six simple types and one list type).

A classifier  assigns  to  each  event  an  identity,  which  makes  it  comparable  to  others  (via  their  assigned  identity).  Examples  of  such  identities  include  the  descriptive  name  of  the  activity  the  event  relates  to,  the  descriptive  name  of  the case the event relates to, the descriptive name of the cause of the event, and the descriptive name of the resource the event relates to.

An extension  defines  a  (possibly  empty) set of attributes for every type of element.  The  extension  provides  points  of  reference  for  interpreting  these  attributes,  and,  thus,  for  their  containing  elements.  Extensions  therefore  are  primarily  a  vehicle  for  attaching  semantics  to  a  set  of  defined  attributes  per  element.  Extensions  have  many  possible  uses.  One  important  use  is  to  introduce  a set of commonly understood attributes which are vital for a specific perspective or  dimension  of  event  log  analysis  (and  which may even not have been foreseen at the time of developing this Standard).

As  an  example,  the  Concept  extension  stores  a  generally  understood  name  for  any  element.  For  logs,  the  name  attribute  may  store  the  name  of  the  process  having  been  executed.  For  traces,  the  name attribute usually stores the case ID. For events, the name attribute represents the  name  of  the  executed  activity  represented  by  the  event.  Other  uses  of  extensions  include  the  definition  of  generally-understood  attributes  for  a  specific  application  domain  (for  example,  medical  attributes  for  hospital  processes), or for supporting special features or requirements of a specific application.

State machine flow diagram for the XES XML serialization