Objective. When integrating the ELK stack into an information system, it is necessary to have a duplicate Java application in a closed circuit for hidden anomaly processing. It is necessary to develop the architecture of a Java application for hidden integration with the information system.Method. The research used methods of analyzing information in information system logs, static analysis methods, programming for application development, and data processing algorithms.Result. An example of implementing the Elasticsearch stack for processing and storing logs is presented. An implementation of anomaly analysis using the official Elasticsearch library is proposed. Options for using Elasticsearch for anomaly analysis are considered, an implementation of anomaly analysis using the official Elasticsearch library is proposed. The architecture of a Java application integrated into an information system for automated log analysis in order to detect computer attacks or signals of their onset by searching for anomalies is proposed. Variants of anomalies in information system logs are considered and actions for their detection are described. A generalized map of the Java application workflow is demonstrated.Conclusion. The architecture of a Java application implementing the analysis of logs of an information system for key anomalies has been developed.