Some embodiments provide a non-transitory machine-readable medium that stores a program. The program receives a log entry instance for creating a definition for a log entry type. The program further generates a markup associated with the log entry instance. The program also generates a document based on the markup associated with the log entry instance. The program further retrieves a set of reference documents. Each reference document is associated with a particular type of event. The program also generates a ranked list of types of events based on the document and the set of reference documents.