# Charting an IP flow based metric **URL:** \ **Category:** Kibana\ **Created:** [August 16, 2017, 12:43pm UTC](https://discuss.elastic.co/t/charting-an-ip-flow-based-metric/97257 "2017-08-16T12:43:16Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![mgillott](https://avatars.discourse-cdn.com/v4/letter/m/a587f6/32.png) [@mgillott](https://discuss.elastic.co/u/mgillott)\ **Post date:** [August 16, 2017, 12:43pm UTC](https://discuss.elastic.co/t/charting-an-ip-flow-based-metric/97257/1 "2017-08-16T12:43:16Z")
I have a series of IP flows with an associated metric that I want to present as a line chart . The flows (SA, DA, SP, DP, AF) have been indexed & the addresses mapped the correct type ("IP"). I now want to visualize the average metric from each individual flow. I'm thinking a line chart with metric value on the Y-axis, date-time on the X-axis and each flow represented as separate line (maybe just the top 10 flows). Whilst I can produce a single line representing the average over all flows and I can generate multiple lines using just the source-address, I can't figure out how to "bind" (?) the SA+DA+SP+DP values into a single line. Any pointers? Thanks, Mark ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [August 16, 2017, 7:35pm UTC](https://discuss.elastic.co/t/charting-an-ip-flow-based-metric/97257/2 "2017-08-16T19:35:34Z")
I think this post would help you; > [@Aggregate multiple records to single chart](https://discuss.elastic.co/t/aggregate-multiple-records-to-single-chart/86561/23): > > Hi Avivc, You still haven't posted example data such that I can understand your question, so I'm making some up. In the Dev Console I did this; POST my\_index/defect/ { "Project.\_refObjectName": "value1" } POST my\_index/defect/ { "Project.\_refObjectName": "value2" } POST my\_index/defect/ { "Project.\_refObjectName": "value3" } POST my\_index/defect/ { "Project.\_refObjectName": "value4" } POST my\_index/defect/ { "Project.\_refObjectName": "value5" } POST my\_index… Specifically, look for this; `Project._refObjectName.keyword=value1 OR Project._refObjectName.keyword=value2` Regards, Lee ---
**Author:** ![mgillott](https://avatars.discourse-cdn.com/v4/letter/m/a587f6/32.png) [@mgillott](https://discuss.elastic.co/u/mgillott)\ **Post date:** [August 17, 2017, 1:42pm UTC](https://discuss.elastic.co/t/charting-an-ip-flow-based-metric/97257/3 "2017-08-17T13:42:25Z")
Thanks for the pointer. Didn't really understand what the originator was trying to do or the solution - I guess I'm still "challenged" when it comes to understanding the details of ELK! I did try adding a filter (destination-address='192.168.254.254' and source-address='192.168.1.1') and that worked - I got a line representing the metric average for that flow. Except its all very manual and that's just one flow. Its been suggested that the application that is injecting the records into logstash, should combine the addresses. That is rather than have separate IP source & destination fields, have a single (string) field that is "source-destination". I guess I'll keep playing. Thanks, Mark ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 17, 2017, 2:11pm UTC](https://discuss.elastic.co/t/charting-an-ip-flow-based-metric/97257/4 "2017-08-17T14:11:15Z")
You can have a combined field representing the flow in addition to the separate source and destination IP fields as these may be useful for different types of analysis. ---
**Author:** ![mgillott](https://avatars.discourse-cdn.com/v4/letter/m/a587f6/32.png) [@mgillott](https://discuss.elastic.co/u/mgillott)\ **Post date:** [August 17, 2017, 2:19pm UTC](https://discuss.elastic.co/t/charting-an-ip-flow-based-metric/97257/5 "2017-08-17T14:19:42Z")
Oh yes, that's an idea. It would allow me to analyse flows as well as individual addresses. Thanks Christian. Mark ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [August 17, 2017, 5:15pm UTC](https://discuss.elastic.co/t/charting-an-ip-flow-based-metric/97257/6 "2017-08-17T17:15:05Z")
And you can create a scripted field in Kibana. It's a little bit of a performance hit compared to changing your logstash to create the combined field. But it's pretty quick and easy to combine 2 strings like that. > **[Using Painless in Kibana scripted fields | Elastic](https://www.elastic.co/blog/using-painless-kibana-scripted-fields)** > > Kibana provides powerful ways to search and visualize data stored in Elasticsearch. For the purpose of visualizations, Kibana looks for fields defined in Elasticsearch mappings and presents them as op... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 14, 2017, 5:15pm UTC](https://discuss.elastic.co/t/charting-an-ip-flow-based-metric/97257/7 "2017-09-14T17:15:10Z")
Closed on September 14, 2017, 5:15pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.