A log analysis device includes a correlation model generation unit that generates a correlation model between a pattern of a log output from a monitored target in a prescribed period and the monitored target, based on time series of the pattern and an operating status of the monitored target, and a determination unit that determines existence of an abnormality in the monitored target based on the correlation model.