Recall that in DeepLog’s model for anomaly detection from log keys, the input is a sequence of log keys of length h from recent history, and the output is a probability distribution of all possible log key values. An interesting observation is that its output actually encodes the underlying workflow execution path.