as a total ES Noob I have one essential question.
How do I combine two values from an aggregation?
I am collecting sFlow Data with "ElastiFlow" and have some traffic sums of
the available fields (from sFlow) flow.dst_addr and flow.src_addr.
Generally my target is to see the overall traffic for lets say one IP address.
What I have now: 1 value for ingress, one for egress.
- Extract sum of flow.bytes for a range of IPs (total in AND out)
- Put them into a table as visualization
I have absolutely now clue how to do that in combination.
Could you point to the right direction?
Thanks in advance