---
title: Run a pattern analysis on your log data in Discover
description: Group similar log messages into patterns in Discover to see common structures, filter out noise, and find unusual messages when you troubleshoot.
url: https://www.elastic.co/docs/explore-analyze/discover/run-pattern-analysis-discover
products:
  - Elastic Documentation
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Run a pattern analysis on your log data in Discover
If your logs are free-form messages, pattern analysis groups similar messages into patterns, so you can see which ones are common, filter out the noise, and focus on unusual messages while you troubleshoot. For each pattern, **Discover** shows how its messages are distributed over time in a chart, and gives example documents.

## Before you begin

- Make sure **Discover** is in classic mode. ES|QL mode doesn't support this functionality. To switch, refer to [Switch to Discover's classic mode](/docs/explore-analyze/discover/switch-esql-mode#revert-to-classic-mode).
- You need a [Platinum or Enterprise subscription](https://www.elastic.co/subscriptions) or an active trial for Elastic Stack. Pattern analysis relies on a feature that requires it.
- **Discover** must have a [data view](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views) selected that has a time field and contains a text field, and a time range that contains data.
- This example uses the [web logs sample data](https://www.elastic.co/docs/manage-data/ingest/sample-data). To follow along, add it and select its data view, or use your own log data.

<tip applies-to="Elastic Cloud Serverless: Preview, Elastic Stack: Preview since 9.4">
  In ES|QL mode, you can [group similar messages in a query](/docs/explore-analyze/discover/inspect-grouped-stats#pattern-rendering).
</tip>


## Run a pattern analysis

1. Go to **Discover**.
2. Expand the data view menu, and select **Kibana Sample Data Logs**.
3. If you don't see any results, expand the time range, for example, to **Last 7 days**.
4. Select **Patterns** (or **View as** → **Patterns**, depending on your version). **Discover** groups the messages of a text field into patterns and lists them with the chart.
   ![Patterns view in Discover listing the patterns found in the log messages, with the View as menu open](https://www.elastic.co/docs/explore-analyze/images/kibana-log-pattern-analysis-results.png)
5. Optional: To analyze a different text field, change the field in the field selector.
6. Optional: To calculate patterns over a longer period than the time range you set in step 3, select the `controls` **Options** button to open the **Pattern analysis settings**, and set the **Minimum time range**. A longer range improves accuracy. The list still shows the patterns for the time range you set in step 3.
7. Optional: To focus on specific messages, select one or more patterns, and then select **Filter for patterns in Discover**. To hide the messages that match them instead, select **Filter out patterns in Discover**.

**Result:** **Discover** shows the patterns in your log messages. After you filter, the table shows only the documents that match the patterns you kept, or only the ones that don't match the patterns you filtered out.

## Next steps

To find unusual behavior in a pattern, create a [categorization anomaly detection job](/docs/explore-analyze/machine-learning/anomaly-detection/ml-configuring-categories#creating-categorization-jobs) from the **Patterns** view. This needs permission to create anomaly detection jobs, and **Discover** doesn't show the button without it.

## Related pages

- [How to query in Discover's classic mode](https://www.elastic.co/docs/explore-analyze/discover/use-classic-mode)
- [Search and filter with KQL, Lucene, and filters in Discover's classic mode](https://www.elastic.co/docs/explore-analyze/discover/search-and-filter-classic)