How to synchronize tcpdump/pcap file time with kibana?

[Gurram_Vinay]

I have a JSON data of pcap file as shown in

I want to synchronize in kibana, but Here in kibana, "Index contains time-based events" (if I checked the box then unable to load the "Time-field name"),If I unchecked the box only visualising the normal data with any time frame.

I want to see data with checked time at "Index contains time-based events" along with pcap time frame.

[weltenwort (Felix Stürmer)]

Hi @Gurram_Vinay,

in order to be able to select a field as the time-field in Kibana it has to have the date type in the mapping. Looking at the time fields in the JSON samples you posted you would probably have to preprocess them during ingestion in order for Elasticsearch to parse it correctly as timestamps.

[weltenwort (Felix Stürmer)]

Another option might be to use Packetbeat to ingest the pcap files directly. With that you would also gain access to preconfigured example dashboards in Kibana.