We're trying to get a bandwidth accounting solution running where we want to get graphs on how much bandwidth every individual IP address uses. To do this we are using a tool called pmacct-to-elasticsearch that takes the output from pmacct (uses libpcap to capture traffic on a SPAN port) and sends this to elasticsearch. We then have Kibana to draw graphs based on this data.
The solution aggregates the source IP addresses and sets these together with bytes, packets etc. in separate fields every minute (so a field for IP, a field for bytes etc.). We've gotten as far as to being able to graph the bandwidth used by a IP address over time by searching for "src_ip: xxx.xxx.xxx.xxx" manually. What we would like to do now, if possible, is have all IP addresses in a list or drop down menu where you can simply select one of them and get the graph for the bandwidth usage. Additionally we would like to not have to set each graph manually, as we'll be dealing with a large number of addresses (500-ish), so if we could get Kibana to automatically list all unique addresses in the field that'd be preferred.
Is this at all possible or are we chasing a unicorn?
Thanks in advance.