# How to find bandwidth usage from netflow data **URL:** \ **Category:** Kibana\ **Created:** [October 2, 2016, 12:00pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005 "2016-10-02T12:00:41Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [October 2, 2016, 12:00pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/1 "2016-10-02T12:00:41Z")
I want to display bandwidth usage as on x-axis timestamp and on y-axis data usage in mbps. I have netflow v5 data. How should I do this? Thank you. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 2, 2016, 11:22pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/2 "2016-10-02T23:22:46Z")
Is the data in Elasticsearch? ---
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [October 3, 2016, 9:10am UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/3 "2016-10-03T09:10:55Z")
yes, data is in elasticsearch ``` "@timestamp": "2016-10-01T18:14:24.000Z", "netflow": { "version": 5, "flow_seq_num": 122645, "engine_type": 0, "engine_id": 0, "sampling_algorithm": 0, "sampling_interval": 0, "flow_records": 6, "ipv4_src_addr": "10.0.0.20", "ipv4_dst_addr": "10.0.0.31", "ipv4_next_hop": "0.0.0.0", "input_snmp": 8, "output_snmp": 1, "in_pkts": 1, "in_bytes": 64, "first_switched": "2016-10-01T18:13:24.000Z", "last_switched": "2016-10-01T18:14:24.000Z", "l4_src_port": 5246, "l4_dst_port": 80, "tcp_flags": 0, "protocol": 17, "src_tos": 1, "src_as": 20, "dst_as": 13, "src_mask": 32, "dst_mask": 31 ``` I want to add "in\_bytes" received per second. And also want to edit y-axis label in kibana linechart ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [October 3, 2016, 11:45am UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/4 "2016-10-03T11:45:05Z")
Ok, so have you built a line graph yet? ---
**Author:** ![Saurabh\_Jambhule](https://avatars.discourse-cdn.com/v4/letter/s/c0e974/32.png) [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Post date:** [October 6, 2016, 6:06am UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/5 "2016-10-06T06:06:34Z")
Yes, I have done that. But I want to display customized label on y-axis like data usage in Mbps. How to do this? ---
**Author:** ![pereyrdi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pereyrdi/32/12480_2.png) [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Post date:** [April 7, 2017, 6:25pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/6 "2017-04-07T18:25:09Z")
Saurabh, Did you calculate the bandwith from 'in\_bytes'? I just sum the values from 'in\_bytes', but that not the real bandwith utilization, there is more math to calculate. If I solve it, i will publish it =) diego ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 8, 2017, 6:45am UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/7 "2017-04-08T06:45:54Z")
Timelion has a function called `scale_interval` which I often use to get rates per time interval. ---
**Author:** ![pereyrdi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pereyrdi/32/12480_2.png) [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Post date:** [April 10, 2017, 3:07pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/8 "2017-04-10T15:07:13Z")
Christian, please an example for the newbies 🙂 Something like this you mean ? .es('Hostname:r123', metric='sum:in\_bytes').scale\_interval(30s) show me zero... I want to get bytes traffic filter by host. Thanks ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 10, 2017, 3:29pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/9 "2017-04-10T15:29:44Z")
Assuming we have a `logstash*` index patterns that contains web access logs and the size of each request is stored in a numeric field called `bytes`, the following expression shows downloaded volume as MB/s: `.es(index=logstash*, metric='sum:bytes').divide(1048576).scale_interval('1s').title('MB per second')` ---
**Author:** ![pereyrdi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pereyrdi/32/12480_2.png) [@pereyrdi](https://discuss.elastic.co/u/pereyrdi)\ **Post date:** [April 11, 2017, 11:41am UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/10 "2017-04-11T11:41:46Z")
Thanks a lot !!!! ---
**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Post date:** [June 1, 2017, 11:55am UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/11 "2017-06-01T11:55:24Z")
Hi Christian, Its wonderful update but is that MB/s or MB/minute ,am confused 🙂 Thanks, Raj ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 1, 2017, 12:09pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/12 "2017-06-01T12:09:49Z")
There seems to be a typo there and the interval should indeed be `1s` in order to get per second value. Have updated the interval as well as the title. ---
**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Post date:** [June 1, 2017, 12:10pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/13 "2017-06-01T12:10:45Z")
Gotcha 🙂 Thank you for the response ---
**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Post date:** [June 1, 2017, 12:15pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/14 "2017-06-01T12:15:38Z")
One Query Christian,if I want in mbps ,can i multiply with 8 .es(index=logstash\*, metric='sum:bytes').divide(1048576).scale\_interval('1s').title('MB per second') ,how can use that function in this query ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [June 1, 2017, 12:26pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/15 "2017-06-01T12:26:48Z")
I guess you could divide by 131072 instead of 1048576. ---
**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Post date:** [June 1, 2017, 12:32pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/16 "2017-06-01T12:32:25Z")
Thank you 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:31pm UTC](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/17 "2017-07-06T13:31:37Z")