The XES Standard for Exchanging Event Logs Approved by IEEE SA

By Wil van der Aalst and Eric Verbeek
November 24, 2016

Eindhoven, The Netherlands – On November 11th, 2016, the IEEE Standards Association has officially published the XES Standard as IEEE Std 1849TM-2016: IEEE Standard for eXtensible Event Stream (XES) for Achieving Interopability in Event Logs and Event Streams. The IEEE Task Force on Process Mining has been driving the standardization process for over six years, because the standard allows for the exchange of event data between different process mining tools.

Through the XES Standard, event data can be transported from the location where it was generated to the location where it can be stored and analyzed, without losing semantics. The XES Standard enforces that this transport and storage is done in a standardized way, that is, in a way that is clear and well-understood. Next to providing a standardized syntax and semantics, the XES Standard also allows for extensions, e.g., adding cost information or domain specific attributes to events.

Why do we need the XES Standard?

Event data are omnipresent. Data are collected about anything, at any time, and at any place. Nowadays, the term “Big Data” is often used to refer the expanding capabilities of information systems and other systems that depend on computing. The importance of information systems is not only reflected by the spectacular growth of data, but also by the role that these systems play in today’s business processes as the digital universe and the physical universe are becoming more and more aligned. The close connection between reality and event data allows us to learn behavior.

The term Internet of Events (IoE) refers to all event data available. The IoE is composed of:

  • The Internet of Content (IoC): all information created by humans to increase knowledge on particular subjects. The IoC includes traditional web pages, articles, encyclopedia like Wikipedia, YouTube, e-books, newsfeeds, etc.
  • The Internet of People (IoP): all event data related to social interaction. The IoP includes e-mail, Facebook, Twitter, forums, LinkedIn, etc.
  • The Internet of Things (IoT): all event generated by physical objects connected to the network. The IoT includes all things that have a unique id and a presence in an Internet-like structure.
  • The Internet of Locations (IoL): refers to all data that have a geographical or geospatial dimension. With the uptake of mobile devices (e.g., smartphones) more and more events have location or movement attributes.

To use this wealth of event data, we need to be able to transport, store, and exchange (possibly large volumes of) events. Events have particular properties. For example, events have a timestamps and are about something (case). There are other standard attributes like activity, resource, transaction type, etc. XES allows for the transportation, storage, and exchange of events without losing semantics.

Killer application for XES: Process Mining

Process mining is an emerging discipline providing comprehensive sets of tools to provide fact-based insights and to support process improvements. This new discipline builds on process model-driven approaches and data mining. Process mining provides a generic collection of techniques to turn event data into valuable insights, improvement ideas, predictions, and recommendations. Starting point for any process mining effort is a collection of events commonly referred to as an event log (although events can also be stored in a database and may be only available as an event stream). A wide range of process mining techniques is available to extract value and actionable information from event data. Process discovery techniques take an event log or event stream as input and produce a process model without using any a-priori information. Conformance checking can be used to check if reality, reflected by the event data, conforms to a predefined process model and vice versa. Process mining can also be used to extend process models with performance-related information, e.g., bottlenecks, waste, and costs. It is event possible to predict problems and suggest actions.

Currently, there are over 25 commercial process mining tools. In fact, the adoption of process mining has been accelerating in recent years. Currently, there are about 25 software vendors offering process mining tools. Tools like Disco (Fluxicon), Celonis Process Mining, ProcessGold Enterprise Platform, Minit, myInvenio, Signavio Process Intelligence, QPR ProcessAnalyzer, LANA Process Mining, Rialto Process, Icris Process Mining Factory, Worksoft Analyze & Process Mining for SAP, SNP Business Process Analysis, webMethods Process Performance Manager, and Perceptive Process Mining are now available. Moreover, open source tools like ProM, ProM Lite, and RapidProM are widely used. It is vital that event data can be exchanged between these tools. Several of these tools already support XES. For example, it is easy to exchange XES data between Disco, Celonis, ProM, Rialto Process, minit, and SNP.

About the XES Standard

Figure 1 shows the XML serialization for the XES Standard as a state machine flow diagram. The main part of the diagram is the part containing the log, the traces (a trace bundles all events related to some case), the events, and the attributes. As the diagram shows, all these elements may have any number of attributes, and an attribute can be of seven different types (six simple types and one list type).

Figure 1: State machine flow diagram for the XES XML serialization

A classifier assigns to each event an identity, which makes it comparable to others (via their assigned identity). Examples of such identities include the descriptive name of the activity the event relates to, the descriptive name of the case the event relates to, the descriptive name of the cause of the event, and the descriptive name of the resource the event relates to.

An extension defines for every type of element a (possibly empty) set of attributes. The extension provides points of reference for interpreting these attributes, and , thus, for their containing elements. Extensions therefore are primarily a vehicle for attaching semantics to a set of defined attributes per element. Extensions have many possible uses. One important use is to introduce a set of commonly understood attributes which are vital for a specific perspective or dimension of event log analysis (and which may even not have been foreseen at the time of developing this Standard). As an example, the Concept extension stores a generally understood name for any element. For logs, the name attribute may store the name of the process having been executed. For traces, the name attribute usually stores the case ID. For events, the name attribute represents the name of the executed activity represented by the event. Other uses of extensions include the definition of generally-understood attributes for a specific application domain (for example, medical attributes for hospital processes), or for supporting special features or requirements of a specific application.

About the XES Standardization process

The IEEE Task Force on Process Mining in its meeting in New York on September 15th, 2010, initiated the IEEE standardization process for the eXtensible Event Stream standard, or XES in short. To guide this process, in September 2012 an initial small XES Working Group (XES WG) was formed, which reached agreement on the XES Standard in 2013. Then a process followed going through all the stages of the IEEE standardization process while refining the standard (e.g. removing ambiguities). During its meeting on September 22nd, 2016, IEEE SA approved the third external version of the XES Standard. After a short editorial process, the final version of the XES Standard was published by IEEE SA on November 11th, 2016.

The published XES Standard can be found in the IEEE Digital Library (through the URL, and can be referred to using the DOI 10.1109/IEEESTD.2016.7740858.

About the IEEE Task Force on Process Mining

More and more people, both in industry and academia, consider process mining (see the promotional video on for an introduction) as one of the most important innovations in the field of business process management. It joins ideas of process modeling and analysis on the one hand and data mining and machine learning on the other. Therefore, the IEEE has established a Task Force on Process Mining. This Task Force is established in the context of the Data Mining Technical Committee (DMTC) of the Computational Intelligence Society (CIS) of the Institute of Electrical and Electronic Engineers, Inc. (IEEE).

The goal of this Task Force is to promote the research, development, education and understanding of process mining. More concretely, the goal is to:

  • make end-users, developers, consultants, and researchers aware of the state-of-the-art in process mining,
  • promote the use of process mining techniques and tools and stimulating new applications,
  • play a role in standardization efforts for logging event data,
  • the organization of tutorials, special sessions, workshops, panels,
  • the organization of Conferences/Workshop with IEEE CIS Technical Co-Sponsorship, and
  • publications in the form of special issues in journals, books, articles (e.g., in the IEEE Computational Intelligence Magazine).

Note that process mining includes (automated) process discovery (extracting process models from an event log), conformance checking (monitoring deviations by comparing model and log), social network/organizational mining, automated construction of simulation models, case prediction, and history-based recommendations.


To learn more about the XES Standard, or the IEEE Task Force on Process Mining, please contact Wil van der Aalst, Chair of the IEEE Task Force on Process Mining or Eric Verbeek, responsible for the XES standardization process. Visit for more information.

Wil van der Aalst, Chair of the IEEE Task Force on Process Mining,
Phone number: +31 (40) 247 4295/2733
E-mail address:

Eric Verbeek, Secretary of the XES Working Group,
Phone number: +31 (40) 247 3755
E-mail address: