What is the difference between a log entry and an event?¶

The event is the recognised activity or condition; the log entry is one system's recorded representation of it. They are related but not interchangeable.

One event can produce several records¶

A credential submission may create entries for request receipt, authentication, token issue, session creation and central ingestion. Different clocks and observation points explain different times. Conversely, one entry or alert can summarise several attempts.

Normalisation, enrichment and dashboard labels may also transform the source fields.

Establish which representation you hold¶

Determine whether the record is source, collected, normalised, exported or alert-derived. Preserve event codes, request, session and correlation IDs, field meanings and surrounding entries across relevant systems.

Do not infer duplicate human actions from duplicate rows or one action from one row. Report the underlying event separately from each system record about it.