# How to see/synchronize pcap file "Time" with kibana visualization?

**URL:** <https://discuss.elastic.co/t/how-to-see-synchronize-pcap-file-time-with-kibana-visualization/83430>\
**Category:** Kibana\
**Created:** [April 24, 2017, 3:11pm UTC](https://discuss.elastic.co/t/how-to-see-synchronize-pcap-file-time-with-kibana-visualization/83430 "2017-04-24T15:11:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurram\_Vinay](https://avatars.discourse-cdn.com/v4/letter/g/85e7bf/32.png) [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\
**Post date:** [April 24, 2017, 3:11pm UTC](https://discuss.elastic.co/t/how-to-see-synchronize-pcap-file-time-with-kibana-visualization/83430/1 "2017-04-24T15:11:51Z")

</div>

How to see pcap data with respect to pcap time events in kibana?

Here in kibana, "Index contains time-based events" (if I checked the box then unable to load the "Time-field name"),If I unchecked the box only visualising the normal data with any time frame.

I want to see data with checked time at "Index contains time-based events" along with pcap time frame.

Below is my data ,

```auto
curl -XGET localhost:9200/test2/pcap2/327?pretty
{
  "_index" : "test2",
  "_type" : "pcap2",
  "_id" : "327",
  "_version" : 1,
  "found" : true,
  "_source" : {
    "Info" : "50038 > http [ACK] Seq=239 Ack=166 Win=64076 Len=0",
    "No." : "327",
    "Protocol" : "TCP",
    "Destination" : "185.158.152.205",
    "Source" : "10.10.31.101",
    "Length" : "60",
    **"Time" : "390.453793"**
  }
}

```

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [April 24, 2017, 11:20pm UTC](https://discuss.elastic.co/t/how-to-see-synchronize-pcap-file-time-with-kibana-visualization/83430/2 "2017-04-24T23:20:23Z")

</div>

You'll need to convert the pcap time value into a time field that elasticsearch understands. Consider using logstash with the [https://github.com/purbon/logstash-input-pcap](https://github.com/purbon/logstash-input-pcap) plugin

---

<div class="post-metadata">

**Author:** ![Gurram\_Vinay](https://avatars.discourse-cdn.com/v4/letter/g/85e7bf/32.png) [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\
**Post date:** [April 25, 2017, 10:04am UTC](https://discuss.elastic.co/t/how-to-see-synchronize-pcap-file-time-with-kibana-visualization/83430/3 "2017-04-25T10:04:20Z")

</div>

I had imported into elasticsearch without [logstash.So](http://logstash.So) could you please let me know to elasticsearch ? or any otherway? -Thanks for quick response splager

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [April 25, 2017, 2:54pm UTC](https://discuss.elastic.co/t/how-to-see-synchronize-pcap-file-time-with-kibana-visualization/83430/4 "2017-04-25T14:54:34Z")

</div>

You'll have to reindex the data then @Gurram_Vinay, but I'm not sure how to convert the value of the `Time` field into an actual date, which is why I recommend the pcap input for logstash.

Logstash will help you here if you can go back and use it.

---

<div class="post-metadata">

**Author:** ![Gurram\_Vinay](https://avatars.discourse-cdn.com/v4/letter/g/85e7bf/32.png) [@Gurram\_Vinay](https://discuss.elastic.co/u/Gurram_Vinay)\
**Post date:** [April 26, 2017, 9:19am UTC](https://discuss.elastic.co/t/how-to-see-synchronize-pcap-file-time-with-kibana-visualization/83430/5 "2017-04-26T09:19:38Z")

</div>

well, my intention was to do some static analysis using of packet capture files(a bunch of pcap's). I wanted to do some specific data - analytics or search which is possible by the only elasticsearch, however, it is not possible through logstash. Well, after the analytics -- I want to visualise them through kibana(specifically with the time stamp of pcap). Well thanks for reply -@spalger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 24, 2017, 9:20am UTC](https://discuss.elastic.co/t/how-to-see-synchronize-pcap-file-time-with-kibana-visualization/83430/6 "2017-05-24T09:20:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.