# Log Anomaly Doesn't Work?

**URL:** <https://discuss.elastic.co/t/log-anomaly-doesnt-work/382329>\
**Category:** Kibana\
**Created:** [September 30, 2025, 3:52pm UTC](https://discuss.elastic.co/t/log-anomaly-doesnt-work/382329 "2025-09-30T15:52:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [September 30, 2025, 3:52pm UTC](https://discuss.elastic.co/t/log-anomaly-doesnt-work/382329/1 "2025-09-30T15:52:13Z")

</div>

ES/Kibana 9.1.3  
I get this error:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/6/66f366295c61546512c8205db8c18515674897c7.png)

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [October 4, 2025, 3:30am UTC](https://discuss.elastic.co/t/log-anomaly-doesnt-work/382329/2 "2025-10-04T03:30:18Z")

</div>

Hello @erikg

As per the link :

_Choose indices By default, Machine Learning analyzes log messages in all log indices configured for the log sources setting. You can choose to only analyze a subset of the index names. Every selected index name must match at least one index with log entries. You can also choose to only include a certain subset of datasets. Note that the dataset filter applies to all selected indices._

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f857ac00c1590de93bd8a4806300608c3c6dcac0.png)

So in your case there is no pattern found for above 3 in the cluster.

I tried testing with sample logs & pattern is updated :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8aa81c084124683f4d30b2e9685c828be380e3d0.png)

Thanks!!