Hello Kibana gurus,
Boy, I need your help. I have built a network sFlow collector, which collects a lot of network data. That data is successfully flowing into Elasticsearch & Kibana. Let’s say for a toy example, I can see the following data in Kibana:
Sender Receiver Protocol Sample Rate Total Length 10.10.10.10 126.96.36.199 TCP 64 1500 10.10.10.10 188.8.131.52 UDP 64 1500 10.10.10.10 184.108.40.206 TCP 64 1500 220.127.116.11 10.10.10.10 TCP 64 1500 10.10.10.10 18.104.22.168 TCP 64 1500 10.10.10.10 22.214.171.124 TCP 64 100 10.10.10.10 126.96.36.199 UDP 64 1500
I can combine that data by merging whenever Sender/Receiver/Protocol/Sample Rate stats are the same and summing “Total Length”:
Sender Receiver Protocol Sample Rate Total Length 10.10.10.10 188.8.131.52 TCP 64 4600 10.10.10.10 184.108.40.206 UDP 64 3000 220.127.116.11 10.10.10.10 TCP 64 1500
What’s more, because this is sampled data, I really need to multiply those last columns:
Sender Receiver Protocol Total Data Sent 10.10.10.10 18.104.22.168 TCP 294400 10.10.10.10 22.214.171.124 UDP 192000 126.96.36.199 10.10.10.10 TCP 96000
This is highly useful. What I need is a Kibana Visualization that produces the last chart.
I’ve been reading through the Kibana documentation and tutorials and just haven’t gotten very far at all. Obviously, I want a Data Table type. My buckets would be Sender / Receiver / Protocol / Sample Rate… I assume. But I’m uncertain how to specify the Metrics here: These would be… sums? Unique counts? I’m not sure.
Can anyone point me to a tutorial or offer some advice on how to build this kind of Visualization? Is this something that can be done in one Visualization, or would I have to potentially build visualizations on top of one another, as I might have to build a MySQL query?