# Unable to find job message fields in ".ml-anomalies\*" index

**URL:** <https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537>\
**Category:** Kibana\
**Tags:** elastic-stack-machine-learning\
**Created:** [March 20, 2026, 1:48am UTC](https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537 "2026-03-20T01:48:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 20, 2026, 1:48am UTC](https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537/1 "2026-03-20T01:48:14Z")

</div>

Machine Learning \>\> Anomaly Detection \>\> Jobs

I am trying to come out with an ESQL query to consolidate all job messages that is non-info. warning or errors.

Example of message

```auto
Time Node Message
202X-XX-XX 16:24:32	instance-XXXXXX Datafeed has missed 12 documents due to ingest latency

```

However I am facing trouble finding the correct table to retrieve the message.

I have attempted to use the ".ml-anomalies\*" index pattern but to no avail.

I can see the jobs but i cant locate the message fields. any advice?

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 20, 2026, 8:58am UTC](https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537/2 "2026-03-20T08:58:05Z")

</div>

Hello @Whoami1980

If you are looking for below messages :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/a/4ae0325a471a15647829aaaa4ec7c3275cb06511.png)

Check for index .ml-notifications-\*

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/3/132d1a6f3f3411aee3857983992f95ef38d91fc0.png)

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 20, 2026, 9:54am UTC](https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537/3 "2026-03-20T09:54:18Z")

</div>

I tried with index .ml-notifications-\*  
it appears it only have the field "forecast\_messages"  
but it doesnt have the field "message" ☹

```auto
POST /_query?format=txt
{
  "query": """
  FROM .ml-anomalies*
| WHERE (job_id) == "pred_maint-firewall-deny-high-count"
    AND message IN ("Datafeed stopped", "Job opened")
| LIMIT 10
    """
}

```

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "verification_exception",
        "reason": """Found 1 problem
line 4:9: Unknown column [message]"""
      }
    ],
    "type": "verification_exception",
    "reason": """Found 1 problem
line 4:9: Unknown column [message]"""
  },
  "status": 400
}

```

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [March 20, 2026, 10:08am UTC](https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537/4 "2026-03-20T10:08:51Z")

</div>

Hello @Whoami1980

I see the index name is wrong & not the one which was suggested :

```auto
POST /_query?format=txt
{
  "query": """
  FROM .ml-notifications*
| WHERE (job_id) == "kibana-logs"
    AND message IN ("Datafeed stopped", "Job opened")
| LIMIT 10
    """
}

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e999a1d10a115dc2c0d8981644e73691f44cd8fe.png)

I am not sure if for 8.19.x the field name is different in that case you can use that fieldname what is available in the index.

Thanks!!

---

<div class="post-metadata">

**Author:** ![Whoami1980](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/whoami1980/32/147545_2.png) [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\
**Post date:** [March 23, 2026, 9:20am UTC](https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537/5 "2026-03-23T09:20:57Z")

</div>

noted. thanks. With the correct index name. i can see the data.

Now the issue how can i use the index name to find the correct data view.

I want to use the discover GUI to see what fields is available for me.