# Building a network topology with Graph

**URL:** <https://discuss.elastic.co/t/building-a-network-topology-with-graph/166064>\
**Category:** Kibana\
**Tags:** elastic-stack-graph\
**Created:** [January 29, 2019, 12:23am UTC](https://discuss.elastic.co/t/building-a-network-topology-with-graph/166064 "2019-01-29T00:23:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![moreauap96](https://avatars.discourse-cdn.com/v4/letter/m/e495f1/32.png) [@moreauap96](https://discuss.elastic.co/u/moreauap96)\
**Post date:** [January 29, 2019, 12:23am UTC](https://discuss.elastic.co/t/building-a-network-topology-with-graph/166064/1 "2019-01-29T00:23:17Z")

</div>

Good Evening,

I am currently working to generate a real time network topology based off NetFlow data (using the Logstash module for ingestion) then using graph to visualize it.

My current settings:

significant links: off  
Certainty: 1  
Diversity field: none  
filter: \*

This currently works well to show the links between devices but I was curious if there was a way to use aggregations for the vertices. I am looking to see the sum of bytes transferred or number of packets instead of the current setting of doc count. Any advice would be greatly appreciated.

Thanks,  
Andrew Moreau

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [January 29, 2019, 3:53pm UTC](https://discuss.elastic.co/t/building-a-network-topology-with-graph/166064/2 "2019-01-29T15:53:46Z")

</div>

> [@moreauap96](#):
>
> I was curious if there was a way to use aggregations for the vertices. I am looking to see the sum of bytes transferred or number of packets instead of the current setting of doc count

Using drill-down links [1] it is possible to show extra information on selected nodes using external URLs eg to take you off to other parts of Kibana to use other visualisations. The heatmap visualization is one example of a visualization where you can use a 2d grid of terms to break down interactions between these entities, totalling bytes or whatever.  
If you want to hand-roll your own custom visualization (eg time sliders to filter lines, lines sized by bytes transferred, horizontal swimlanes for IPs with vertical lines representing comms over time etc) then link out to your own app with the nodes list and then use the new `adjacency_matrix` aggregation to get temporal, financial etc summaries behind all the connecting lines.

[1] [https://youtu.be/ZMmod1Hg92s?t=71](https://youtu.be/ZMmod1Hg92s?t=71)

---

<div class="post-metadata">

**Author:** ![moreauap96](https://avatars.discourse-cdn.com/v4/letter/m/e495f1/32.png) [@moreauap96](https://discuss.elastic.co/u/moreauap96)\
**Post date:** [January 29, 2019, 5:58pm UTC](https://discuss.elastic.co/t/building-a-network-topology-with-graph/166064/3 "2019-01-29T17:58:29Z")

</div>

Thank you so much @Mark_Harwood The drill-down links did the trick!

I noticed that you can change the icon color if you group items but I was wondering if there is any way to change the icon once they are grouped? I ask because I am grouping machines that are chained together, such that they play the role of both src ip and dst ip and once I have grouped those IPs I want to set unique icons for each.  
Thanks,  
Andrew Moreau

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [January 29, 2019, 6:18pm UTC](https://discuss.elastic.co/t/building-a-network-topology-with-graph/166064/4 "2019-01-29T18:18:14Z")

</div>

> [@moreauap96](#):
>
> I was wondering if there is any way to change the icon once they are grouped?

Sadly, no. The icons are tied to a field not a node.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 26, 2019, 6:18pm UTC](https://discuss.elastic.co/t/building-a-network-topology-with-graph/166064/5 "2019-02-26T18:18:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.