System parses fields in a log entry, corresponding to a system user event, to identify a log code for a first and second log entry types. System identifies a common schema for the first and second log entry types. System identifies a schema identifier by applying the common schema to the log entry. The schema identifier corresponds to a schema in a container for the first log entry type or a container for the second log entry type. The container for the first log entry type includes the common schema and a first schema that is specific to the first log entry type. The container for the second log entry type includes the common schema and a second schema that is specific to the second log entry type. System identifies log data by using the corresponding schema to parse fields in the log entry, and outputs the log data.