# Elasticsearch Kibana **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-monitoring\ **Created:** [April 9, 2024, 9:51am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049 "2024-04-09T09:51:11Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Nicnathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Post date:** [April 9, 2024, 9:51am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/1 "2024-04-09T09:51:11Z")
Hi I recently started testing Elasticsearch Kibana's anomaly detection and so far it is working fine where anomalies are detected. However I am wondering if I am able to click something that brings me to the log that was flagged out as an anomaly as I am unable to do that. ---
**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\ **Post date:** [April 9, 2024, 3:55pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/2 "2024-04-09T15:55:55Z")
Welcome, @Nicnathaniel. Would something like what's described in [this guide](https://www.elastic.co/guide/en/observability/current/inspect-log-anomalies.html) be helpful here? Thanks, Jessica ---
**Author:** ![Nicnathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Post date:** [April 11, 2024, 7:19am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/3 "2024-04-11T07:19:26Z")
Hi i don't think so as I am using kibana ---
**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\ **Post date:** [April 12, 2024, 3:08pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/4 "2024-04-12T15:08:05Z")
Thanks @Nicnathaniel. Oh wow, I meant to send [this guide](https://www.elastic.co/guide/en/kibana/current/xpack-ml-anomalies.html) instead. Sorry about that! I was thinking that something like Anomaly Explorer or Single Metric Viewer might be a good fit here. ---
**Author:** ![Nicnathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Post date:** [April 15, 2024, 7:12am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/5 "2024-04-15T07:12:10Z")
Hi @jessgarson , Thank you but i have already read through i don't think it is what i am looking for. I was wondering if it is possible to get the exact logs that being flagged out as anomalies. ---
**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\ **Post date:** [April 15, 2024, 7:43pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/6 "2024-04-15T19:43:50Z")
Thanks, @Nicnathaniel. I checked in with some coworkers on this subject, and I'll let you know when I hear more. ---
**Author:** ![Nicnathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Post date:** [April 16, 2024, 12:41am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/7 "2024-04-16T00:41:11Z")
Alright thank you very much! ---
**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\ **Post date:** [April 16, 2024, 1:36am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/8 "2024-04-16T01:36:44Z")
Thanks, @Nicnathaniel. Could [raw data](https://www.elastic.co/guide/en/machine-learning/current/ml-getting-started.html) be what you are looking for? ---
**Author:** ![Nicnathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Post date:** [April 16, 2024, 1:51am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/9 "2024-04-16T01:51:46Z")
Yes, i was wondering if i set a webhook for anomaly detection, am i able to get the raw data that triggered as anomaly ---
**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\ **Post date:** [April 16, 2024, 7:55pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/10 "2024-04-16T19:55:07Z")
Thanks, @Nicnathaniel. I think this could work, but I haven't tested this myself. How were you thinking of setting up the webhook? ---
**Author:** ![Nicnathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Post date:** [April 19, 2024, 2:38am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/11 "2024-04-19T02:38:30Z")
Hi @jessgarson , my initial plan was to use the webhook from anomaly detection to get the raw log that is flagged out as an anomaly to pass the logs to a NLP model to generate queries. I am not sure how feasible it is now as i am unable to view the raw logs from the anomaly detection dashboard. ---
**Author:** ![jessgarson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jessgarson/32/129841_2.png) [@jessgarson](https://discuss.elastic.co/u/jessgarson)\ **Post date:** [April 22, 2024, 2:18pm UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/12 "2024-04-22T14:18:40Z")
Thanks for following up. Have you tried looking at the “Raw data” option in the Actions column? I understand that you could create a query for the pertinent documents in Discover and enrich the actions menu by incorporating custom URLs if needed. Could that method work here? ---
**Author:** ![Nicnathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Post date:** [April 24, 2024, 2:05am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/13 "2024-04-24T02:05:30Z")
Hi I am not sure where to find the "raw data" option ---
**Author:** ![Nicnathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nicnathaniel](https://discuss.elastic.co/u/Nicnathaniel)\ **Post date:** [April 24, 2024, 2:06am UTC](https://discuss.elastic.co/t/elasticsearch-kibana/357049/14 "2024-04-24T02:06:01Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9b449125696388780e4fff611b03a17f4523063.png)