Thanks for your response, Tanya.
My use case:
My organization use a class A private network (10.X.X.X) while my team use a subnet (10.7.A.X). I want to do some visualization on the network traffic in my network, i.e. how the hosts in my team “communicate” with others. I expect seeing several clusters of IPs:
A cluster of hosts with 10.7.A.X meaning my team is accessing hosts/servers inside our team network.
Certain dedicated hosts 10.X.X.X meaning my organization servers (DNS, web, etc) is supporting my team
Certain dedicated common hosts (e.g. yahoo, google, etc) meaning my team is accessing outside service
In this case, the actual geolocation is not relevant to me. In particular, cluster 1 and 2 will be at the same location which doesn’t mean anything to me. At DAVIX 2014 live CD (http://www.secviz.org/node/89), it includes a demonstration (see https://github.com/secviz/davix/wiki/User-Guide:-AfterGlow) on using tshark (to capture traffic as CSV), afterglow (to transform as GraphViz dot file) and neato (to generate png/gif) to visualize the network traffic into something like this: (http://afterglow.sourceforge.net/) (Note: this IS NOT my network, so don’t see previous 3 points)
In general, it well serves my purpose. But the problem is when too many links are overlapping each other, I see nothing at all (like the central cluster). Therefore, if I can use the “filter” function of Kibana to filter out certain IPs, I expect to see something interesting.
Similar approach can be used to do relationship analysis, like email traffic.
I want to confirm if the current Kibana can do something like this? If yes, how to do?
If no, can current Kibana “call” external program for visualization? Wishfully, it could be something like this: after using tshark to capture the traffic and using elasticsearch to store, I can use the filter of Kibana to select and filter out some ips, then it will “pipe” the data to my designated script which both afterglow and neato to generate the png/gif file and present at Kibana dashboard.
If still no, does this request similar to anything in the Kibana development plan which I may see in the near future (say 1-3months)?