# How can I visualize "top-talkers" from netflow data?

**URL:** <https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791>\
**Category:** Kibana\
**Created:** [December 22, 2016, 12:57pm UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791 "2016-12-22T12:57:10Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![sliddjur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sliddjur/32/65260_2.png) [@sliddjur](https://discuss.elastic.co/u/sliddjur)\
**Post date:** [December 22, 2016, 12:57pm UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791/1 "2016-12-22T12:57:10Z")

</div>

Hello I want to visualize top-talkers from netflow data.

With a top-talkers I mean data sent from source to destination, as well as the data replied from the same dst and src.

I would like to stack this data in a vertical bar, and list the top-talkers based on flows/bytes etc. Something similar to this is what I'm trying to achive [http://blog.linoxide.com/wp-content/uploads/2013/11/ntopng\_flows.png](http://blog.linoxide.com/wp-content/uploads/2013/11/ntopng_flows.png)

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [December 22, 2016, 5:14pm UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791/2 "2016-12-22T17:14:31Z")

</div>

Can you give me an example of what your documents might look like? I'm thinking something like this:

```json
{
  "src": "1.2.3.4",
  "dest": "2.3.4.5",
  "bytes": 42
}

```

---

<div class="post-metadata">

**Author:** ![sliddjur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sliddjur/32/65260_2.png) [@sliddjur](https://discuss.elastic.co/u/sliddjur)\
**Post date:** [December 23, 2016, 8:56am UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791/3 "2016-12-23T08:56:03Z")

</div>

@spalger yes thats what it looks like.  
I'm intrested in netflow.ipv4\_src\_addr, netflow.ipv4\_dst\_addr and netflow.in\_bytes

```
{
  "_index": "netflow-2016.12.23",
  "_type": "netflow",
  "_id": "AVkq4HlGRFxRys8jOYJN",
  "_score": null,
  "_source": {
    "netflow": {
      "ipv4_src_host": "192.168.0.51",
      "in_pkts": 3,
      "first_switched": "2016-12-23T08:47:52.999Z",
      "flowset_id": 256,
      "l4_src_port": 56054,
      "ipv4_next_hop": "x.x.128.1",
      "ipv4_dst_host": "edge-z-m-mini-shv-01-amt2.facebook.com",
      "in_bytes": 156,
      "protocol": 6,
      "tcp_flags": 17,
      "xlate_src_addr_ipv4": "192.168.0.51",
      "l4_dst_port": 443,
      "output_snmp": 15,
      "out_src_mac": "e4:8d:8c:20:ed:e2",
      "dst_mask": 0,
      "xlate_src_port": 0,
      "ipv4_dst_addr": "31.13.64.36",
      "src_tos": 0,
      "in_dst_mac": "xx:xx:xx:20:ed:e6",
      "src_mask": 0,
      "xlate_dst_port": 0,
      "version": 9,
      "flow_seq_num": 29029,
      "ipv4_src_addr": "192.168.0.51",
      "last_switched": "2016-12-23T08:48:04.999Z",
      "input_snmp": 13,
      "xlate_dst_addr_ipv4": "31.13.64.36",
      "protocol_name": "TCP"
    },
    "dst_geoip": {
      "timezone": "Europe/Dublin",
      "ip": "31.13.64.36",
      "latitude": 53.3472,
      "country_code2": "IE",
      "country_name": "Ireland",
      "continent_code": "EU",
      "country_code3": "IE",
      "location": [
        -6.2439,
        53.3472
      ],
      "longitude": -6.2439
    },
    "@timestamp": "2016-12-23T08:48:20.000Z",
    "@version": "1",
    "host": "192.168.0.1",
    "src_geoip": {},
    "type": "netflow",
    "tags": [
      "netflow",
      "_geoip_lookup_failure"
    ]
  },
  "fields": {
    "netflow.first_switched": [
      1482482872999
    ],
    "netflow.last_switched": [
      1482482884999
    ],
    "@timestamp": [
      1482482900000
    ]
  },
  "sort": [
    1482482900000
  ]
}
```

---

<div class="post-metadata">

**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\
**Post date:** [December 23, 2016, 12:37pm UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791/4 "2016-12-23T12:37:21Z")

</div>

Its not possible to do it with scripted fields as ip fields are not accessible from scripts. I suppose you want to do this without reindexing your data ? @spalger did you have something specific in mind ?

---

<div class="post-metadata">

**Author:** ![sliddjur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sliddjur/32/65260_2.png) [@sliddjur](https://discuss.elastic.co/u/sliddjur)\
**Post date:** [December 24, 2016, 10:47pm UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791/5 "2016-12-24T22:47:51Z")

</div>

@ppisljar is it possible with strings? How?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [December 25, 2016, 7:31am UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791/6 "2016-12-25T07:31:39Z")

</div>

Since you want to group records with different source and destination fields, I suspect the most efficient way would be to create some type of conversation ID at indexing time. Add the source and destination fields (host and port\*) to an array, sort it and concatenate it to a string with some kind of separator.

If you also want to show duration like in your example at scale, you may want to consider creating an entity-centric index for that.

---

<div class="post-metadata">

**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\
**Post date:** [December 25, 2016, 9:35am UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791/7 "2016-12-25T09:35:12Z")

</div>

yes, with strings its possible. but if you can update your mappings (reindex, or your data is not yet indexed) then what Christian suggests would be best.

with scripted fields you could do something like:

return (doc['ip\_from\_string'].value \< doc['ip\_to\_string'].value ? doc['ip\_from\_string'].value + '-' + doc['ip\_to\_string'].value : doc['ip\_to\_string'].value + '-'+ doc['ip\_from\_string'].value;

this will return something in form 127.0.0.1-200.12.123.2 for this scripted fields (where the smaller ip always come first to make sure we don't have two pairs 127.0.0.1-200.12.123.2 and 200-12.123.2-127.0.0.1 (we want to treat them as one talker group)

let me say this again, if you can add another field at the index time, that would be much better.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 22, 2017, 9:35am UTC](https://discuss.elastic.co/t/how-can-i-visualize-top-talkers-from-netflow-data/69791/8 "2017-01-22T09:35:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.