Extracting Object-Centric Event Logs from Incident Data Using Large Language Models

Incident monitoring is critical in industrial settings to prevent disruptions and optimize operations. While traditional equipment logs are often converted into XES-like event logs, these formats typically associate each event with a single case object and overlook valuable information from other sources, particularly, pre- and post-incident process logs. These additional logs frequently describe activities involving multiple related objects (e.g., hardware, software). OCEL (Object-Centric Event Log) standard can be used to represent events involving multiple, interconnected objects, thus offering a more comprehensive view of incident-related processes. However, pre- and post-incident data are often recorded in unstructured textual formats, whereas OCEL requires well-structured data in order to be properly populated. To bridge this gap, we introduce a method to extract events and objects from unstructured pre- and post-incident textual content that leverages Large Language Models (LLMs). Our approach is evaluated on real-world data from the data center domain demonstrating its effectiveness in enriching incident monitoring and providing a structured foundation for advanced incident prediction and analysis.