1. A computer-implemented method for classifying a token of an unstructured event according to one of a plurality of fields of a structured event schema, comprising: calculating, by at least one hardware processor, a probability for each of the plurality of fields of the structured event schema, wherein the calculated probability for each field represents a likelihood that the token is mapped to that field; ranking the calculated probabilities for the plurality of fields in a descending order from a highest probability to a lowest probability; comparing the highest probability to a threshold; and in response to the highest probability exceeding the threshold, mapping the token to one of the plurality of fields having the highest probability.