Every event needs a defensible order.

Coming soon

A pile of timestamps is not a process history. Identify the work object, name the activity and declare the order of events. Those decisions determine what the analysis can establish.

Prepare the data Open the worked example

The dark Reader process map connects order items, deliveries, orders and invoices through recorded activities and transitions. — Object-centric process map from the development demo.

01 / The contract

What a process mining event log needs.

An event log connects a work item to the steps recorded against it. Identify the work object or process instance, name the activity and declare the event order in the source configuration. Timestamps support time-based analysis; they do not automatically establish process order. Further fields enable duration, people, cost or control questions when their meaning is declared.

Identity

Which work item?

Use case_id or an explicitly identified work-object key. Customer or employee IDs cannot substitute for the process instance without an explicit relationship.

Activity

What happened?

activity names the recorded step. A status field alone may describe the current state, not the history of changes.

Sequence

Declare event order.

Declare the source’s event order, for example with step_no. Equal times, reordered exports and missing sequence fields need explicit handling.

Duration and people

What else can be measured?

started and finished support elapsed step intervals. handled_by supports people and handover analysis. Neither should be silently inferred.

02 / Inspect the actual file

Inspect the sample event log.

This is an excerpt from claims_ops.csv, the input shipped with the published Ghost Observatory sample. The column names and values below come straight from that downloadable file. Three rows belong to the same claim.

Selected columns from the published synthetic claims_ops.csv
event_ref	case_id	step_no	activity	started
C-1000-01	C-1000	1	Register Claim	2026-03-30 08:00:00.566
C-1000-02	C-1000	2	Review Claim	2026-03-30 08:09:10.197
C-1000-03	C-1000	3	Request Information	2026-03-30 15:21:39.568

Complete CSV header

event_ref,case_id,parent_case_id,customer_id,step_no,activity,started,finished,handled_by,team,due_date,qa_result,case_status,object_type,object_id,object_role

Download and inspect it.

The full export also includes end times, people, teams, object identifiers and other fields. The executable configuration explicitly maps the columns to their meaning.

Download the CSV

Read the mapping.

The YAML determines which source fields have authority and which questions can be answered.

Inspect sample YAML

03 / Before you run analysis

Five checks before you run.

Keep work objects distinct. Declare event order. Preserve missing timestamps. Identify each event. Separate waiting from working time.

Each check explained

04 / Use it

Start with the records you already have.

Identify the question you want to answer, check the records it needs and map those fields in your configuration.

Supported input formats and fields What is process mining?

Map, order and validate your event log.

A CSV header identifies the columns; a contract declares their meaning. These references separate field mapping, event order and input validation.