Systems and methods for data analysis include correlating event data to provide process instances. The process instances are clustered, using a processor, by representing the process instances as strings and determining distances between strings to form a plurality of clusters. One or more metrics are computed on the plurality of clusters to monitor deviation of the event data.