Abstract
Event logs produced by modern software, cyber-physical systems, and online services are often queried for complex behavioral patterns such as multi-stage workflows, compliance sequences, and anomaly signatures. These patterns are naturally expressed as regular expressions with attribute predicates, yet their evaluation becomes costly when logs are large, distributed across storage nodes, and enriched with high-cardinality fields. Centralized pattern matching can be limited by bandwidth and by automata state explosion, while naive distribution can amplify communication due to frequent cross-partition dependencies. This paper presents a distributed pattern matching algorithm for event logs that combines automata decomposition with partial evaluation to reduce data movement and to localize computation. The approach compiles a guarded pattern into a predicate automaton, decomposes the automaton into fragments aligned with log partitions, and executes local partial runs that produce compact residual summaries. These summaries are merged through a small set of cross-node messages to reconstruct global matches with formal equivalence to a centralized run. The design integrates cost-based query planning, storage-aware fragment placement, and an optimization layer that trades latency, network, and energy under budget constraints. The analysis characterizes computational complexity, message complexity, and approximation options via sketches when exactness is relaxed. An implementation blueprint is provided with attention to performance engineering, distributed execution mechanics, and reproducibility methodology for evaluation on both synthetic and real-world log distributions.