Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for processing event log data. An example event log processing method includes receiving an event log comprising a plurality of event records describing events that have occurred on each of one or more computer systems over a period of time; converting the event log into a graph, comprising: normalizing the plurality of event records, including anonymizing a unique identifier value in each event record and replacing a variable value in each event record with a predetermined value; representing each normalized event record as one or more nodes in the graph; and generating a plurality of event clusters, wherein each event cluster includes an aggregated group of nodes and is generated based on common attributes of and hierarchical relationships between the normalized event records represented by the nodes in the aggregated group.