Count bytes by user


(André De Martini) #1

Hi guys,
I am new to kibana and I am having some trouble with a new dashboard.

What i need to create:
A dashboard showing the top 10 data received by user (under a chosen period).
The problem is that i cant do math with my data received and the amount of times that the value repeat. (Is is difficult to explain by text, so here is a sample):

It should be a Y: bytereceivedcount X: top10users (i guess the vertical bar chart will be better)

My environment is: fortigate > syslog-ng > logstash > elasticsearch > kibana.

Any ideas guys?

Sorry if i did something wrong, I am new here =)


(Joe Fleming) #2

It should be a Y: bytereceivedcount X: top10users

You can't put both users and time on the X-Axis. So, you need to decide which you want.

If you really want users on the X-Axis, you'll want to do a terms agg on the X-Axis for your users, and set the size to 10. Then you'll likely want to do a sum of bytes for the metric, this will show you the total sum of bytes for each user, showing the top 10 users by their total byte count.

If you still want the time in the X-Axis, what you could do is split the lines (or bars) using a terms agg on the user, with a size of 10. This will show the total count in each chunk of time, and the top 10 users for each chunk of time.

Granted my data here is split on user agent instead of user, but the idea is the same. Hope that helps!


(André De Martini) #3

Thanks for the reply.

Your message really helped, I only have 2 questions now:

1- In your first chart, it count the bytes based on what period of time?
2 - How did you get a field "Sum of bytes"? As you can see on my chart, the bytes split on the syze of each syslog registry (like: received 5000x 1024bytes, 100x 512bytes, and etc).


(André De Martini) #4

Hey guys!
I found out that the problem was that my field wasnt on numeric.

Now i got another problem, I filter my chat to show only 5 top users but it shows me a lot of users.

Did I made any mistake there?


(Joe Fleming) #5

Nope, this is actually correct. What it's showing you is the top 5 users per bucket; that is, per time division. So here, your results are being split on 30 second intervals, so for each of those 30 second chunks, it is returning the top 5, so you end up with a lot more the 5 users total. It's a side effect of how query results work in Elasticsearch. I hope that makes sense.


(André De Martini) #6

Thanks Joe, it is all clear now =)


(system) #7