# Difference between Meraki dashboard and netflow graph **URL:** \ **Category:** Kibana\ **Created:** [October 24, 2019, 8:54pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152 "2019-10-24T20:54:23Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jquintard](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Post date:** [October 24, 2019, 8:54pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/1 "2019-10-24T20:54:23Z")
I need to understand why I have difference between my Meraki dashboard and Kibana graph. This graph, from the Meraki dashboard, is related to one client. The max usage is 1,2Mbit/s : ![kibana1](https://us1.discourse-cdn.com/elastic/original/3X/9/3/939d9af4a55bd7755a0c66f4c434f17e719b54b8.png) The same graph from Kibana : ![kibana2](https://us1.discourse-cdn.com/elastic/original/3X/d/e/de881d41b9c3beba8943e34539e3fb46d16ca0ed.png) The peak reported is 41676 MB/s... It's not possible. This timelion use the next expression : `.es(index=filebeat-*, metric='sum:network.bytes').mvavg(3m).divide(1024).scale_interval(1s).title('MB per second')` This expression come from an example found on the forum. Below the values collected from netflow : ![Kibana3](https://us1.discourse-cdn.com/elastic/original/3X/e/5/e579388324abddfa8d1750bf4ec5034e4b22698d.png) Where is the issue ? Why I need to divide the value by 1024 (I received and I want the value in MB). ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [October 24, 2019, 9:39pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/2 "2019-10-24T21:39:18Z")
Hey @jquintard, which version of Kibana are you using? ---
**Author:** ![jquintard](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Post date:** [October 24, 2019, 10:34pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/3 "2019-10-24T22:34:41Z")
7.4.0 I think it's the latest. ---
**Author:** ![jquintard](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Post date:** [October 25, 2019, 10:34am UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/4 "2019-10-25T10:34:31Z")
@Brandon_Kobel do you have an idea about this issue ? ---
**Author:** ![jquintard](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Post date:** [October 25, 2019, 2:30pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/5 "2019-10-25T14:30:45Z")
The documentation [(Network fields](https://www.elastic.co/guide/en/ecs/current/ecs-network.html)) specifies the field "network.bytes" is the sum of "source.bytes" and "destination.bytes". In my case this fields are missing. I have only this values : - netflow.octet\_delta\_count - netflow.packet\_delta\_count - netflow.post\_octet\_delta\_count - netflow.post\_packet\_delta\_count On the other side, Meraki specifies ([Meraki netflow overview](https://documentation.meraki.com/MX/Monitoring_and_Reporting/NetFlow_Overview)) the netflow template sent and specially two field used to collect bytes : - bytes - out\_bytes I don't understand why I have differents values, the relationship between them and how the network.bytes is calculated. Is this possible to have some explication about this ? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [October 25, 2019, 3:56pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/6 "2019-10-25T15:56:07Z")
Hey @jquintard, can you confirm that the `network.bytes` field is a `number`? If so, it will be storing the number of bytes itself. Timelion currently ignores the [Kibana index-pattern field formatters](https://www.elastic.co/guide/en/kibana/current/field-formatters-numeric.html) so if you'd like to convert from bytes to kB or mB in Timelion, you'll have to do this yourself. ---
**Author:** ![jquintard](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Post date:** [October 25, 2019, 9:46pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/7 "2019-10-25T21:46:36Z")
@Brandon_Kobel, it's a number. But I think you have not understand my problem (my poor English probably). I have not an unit issue, I known how to divide the number in timelion. It's just the bytes from the two sources (meraki dashboard and kibana) are not the same (or approximately the same). Example from the previous screenshot : **At 12AM** **Meraki** : around 1,2 Mb/s so 0,15MB/s **Kibana** : around 41 676 MB/s From 0,15MB/s to 41 675 MB/s the gap is huge. I dont understand why 41 675 MB/s (it's just impossible). The previous graph on the thread but with only one minute of data. I receive 22 flow. The first give 68,8MB, the last 137,2MB so in 1 minute, 137,2 - 68,8 = 68,4MB of data are received/send by the interface. The bandwidth is therefore 68,4 / 60 = 1,14MB/s... ![Kibana3](https://us1.discourse-cdn.com/elastic/original/3X/a/4/a422e82efb3a20785413f7d10cc466d41d75253d.png) Now a timelion just with a divide (1024 x 1024). Instead of 137,2 MB on the last flow, timelion give 1335MB (so x10 but why 10 ???). ![kibana4](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b44f99f364568ad09f8705fb0f46b4cbec2f440a.png) The same timelion in an mavg of 1 minute and a scane interval of 1s. The graph display 34MB/s. ![kibana5](https://us1.discourse-cdn.com/elastic/original/3X/b/7/b740924a66dc5bf2f8c94ed97ea3b025ee2d484b.png) So why this differences ? ---
**Author:** ![jquintard](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Post date:** [October 28, 2019, 9:47pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/8 "2019-10-28T21:47:13Z")
@Brandon_Kobel no idea about this issue ? It's a problem with Filebeat/netflow ? the kibana configuration ? the Meraki dashboard ? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [October 29, 2019, 2:49pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/9 "2019-10-29T14:49:41Z")
Hey @jquintard, the following discuss post walks you through how to calculate bytes per second using netflow data and timelion: [Bytes per second - Is it possible?](https://discuss.elastic.co/t/bytes-per-second-is-it-possible/83497/8) ---
**Author:** ![jquintard](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Post date:** [October 29, 2019, 11:37pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/10 "2019-10-29T23:37:46Z")
@rashid, I'm sorry to ask your help, I have read the post, specified by brandon, but it's allready I do. Do you know why I have a big huge between what I see in my meraki dashboard and you I got in kibana... How I can troubleshoot. Thanks your help. ---
**Author:** ![jquintard](https://avatars.discourse-cdn.com/v4/letter/j/ce73a5/32.png) [@jquintard](https://discuss.elastic.co/u/jquintard)\ **Post date:** [November 8, 2019, 5:54pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/11 "2019-11-08T17:54:32Z")
Really no idea ? @rashid @Brandon_Kobel ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 6, 2019, 6:06pm UTC](https://discuss.elastic.co/t/difference-between-meraki-dashboard-and-netflow-graph/205152/12 "2019-12-06T18:06:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.