# Kibaba graph plug in and packet beats data

**URL:** <https://discuss.elastic.co/t/kibaba-graph-plug-in-and-packet-beats-data/64083>\
**Category:** Kibana\
**Created:** [October 27, 2016, 3:30am UTC](https://discuss.elastic.co/t/kibaba-graph-plug-in-and-packet-beats-data/64083 "2016-10-27T03:30:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Laines](https://avatars.discourse-cdn.com/v4/letter/l/e495f1/32.png) [@Laines](https://discuss.elastic.co/u/Laines)\
**Post date:** [October 27, 2016, 3:30am UTC](https://discuss.elastic.co/t/kibaba-graph-plug-in-and-packet-beats-data/64083/1 "2016-10-27T03:30:37Z")

</div>

Hello we played a little with packet beats and the graph plugin for Kibana. Unfortunately we can't get the graph plugin to query any beats data, but we can see the keys in the drop down menu. We used the latest packet beats alpha version. And latest Kibana and elasticsearch version.

Any help apriciated.

Cheers  
Chris

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [October 27, 2016, 3:00pm UTC](https://discuss.elastic.co/t/kibaba-graph-plug-in-and-packet-beats-data/64083/2 "2016-10-27T15:00:19Z")

</div>

Hi Chris,

Here's the simple thing I've found I could do with Graph and packetbeat data.

First I look at packetbeat data in Discover to see what fields have some data that might be interesting. On mine, I saw that `dest.port` showed 9200 (Elasticsearch), 5601 (Kibana), and 22 (ssh).

So I went to Graph, selected packetbeat-\* index pattern, added the dest.port, and put 9200 in the query field. That got me some circles with port numbers including 9200;

 ![](https://us1.discourse-cdn.com/elastic/original/2X/b/bd47b576419c537911d6e70c8837e529520590b7.png)

Then I added source.port and searched again and got some relationships;

 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3f833a820fd961af3b5ce39d1f8214c442887c27.jpg)

One thing I've noticed with Graph is that it seems to require a certain amount of data before it will find and show something. You could look in the Settings and try tweaking a few of the parameters there, but I can't really advise you much on that.

Regards,  
Lee

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:35pm UTC](https://discuss.elastic.co/t/kibaba-graph-plug-in-and-packet-beats-data/64083/3 "2017-07-06T13:35:28Z")

</div>