The described technology is generally directed towards processing structured data corresponding to system information such as alerts, logs, events, health check data and the like, to identify stateful flows from the structured data. Identical flows are combined, similar flows, based on similarity scores obtained from stateful flows are combined, and incremental stateful flows are combined. Neural networks can be used to identify the similar flows and incremental flows. A distribution can be obtained based on counts of the different stateful flows that remain after combining the identical, similar and incremental stateful flows; a neural network that accounts for subtle differences can be used to provide a more accurate distribution than simple counts. Anomalous stateful flows can be identified from the distribution, with some action taken for an anomalous stateful flow, e.g., to send a notification or other output to a support engineer of the like for proactive issue detection.