Charting an IP flow based metric

[mgillott]

I have a series of IP flows with an associated metric that I want to present as a line chart . The flows (SA, DA, SP, DP, AF) have been indexed & the addresses mapped the correct type ("IP").

I now want to visualize the average metric from each individual flow. I'm thinking a line chart with metric value on the Y-axis, date-time on the X-axis and each flow represented as separate line (maybe just the top 10 flows).

Whilst I can produce a single line representing the average over all flows and I can generate multiple lines using just the source-address, I can't figure out how to "bind" (?) the SA+DA+SP+DP values into a single line.

Any pointers?

Thanks,
Mark

[LeeDr (Lee Drengenberg)]

I think this post would help you;

Aggregate multiple records to single chart

Hi Avivc, You still haven't posted example data such that I can understand your question, so I'm making some up. In the Dev Console I did this; POST my_index/defect/ { "Project._refObjectName": "value1" } POST my_index/defect/ { "Project._refObjectName": "value2" } POST my_index/defect/ { "Project._refObjectName": "value3" } POST my_index/defect/ { "Project._refObjectName": "value4" } POST my_index/defect/ { "Project._refObjectName": "value5" } POST my_index…

Specifically, look for this;
Project._refObjectName.keyword=value1 OR Project._refObjectName.keyword=value2

Regards,
Lee

[mgillott]

Thanks for the pointer.

Didn't really understand what the originator was trying to do or the solution - I guess I'm still "challenged" when it comes to understanding the details of ELK!

I did try adding a filter (destination-address='192.168.254.254' and source-address='192.168.1.1') and that worked - I got a line representing the metric average for that flow. Except its all very manual and that's just one flow.

Its been suggested that the application that is injecting the records into logstash, should combine the addresses. That is rather than have separate IP source & destination fields, have a single (string) field that is "source-destination".

I guess I'll keep playing.

Thanks,
Mark

[Christian_Dahlqvist]

You can have a combined field representing the flow in addition to the separate source and destination IP fields as these may be useful for different types of analysis.

[mgillott]

Oh yes, that's an idea. It would allow me to analyse flows as well as individual addresses. Thanks Christian.

Mark

[LeeDr (Lee Drengenberg)]

And you can create a scripted field in Kibana. It's a little bit of a performance hit compared to changing your logstash to create the combined field. But it's pretty quick and easy to combine 2 strings like that.

Using Painless in Kibana scripted fields | Elastic