# Kibana Visualization for netflow.application\_name **URL:** \ **Category:** Kibana\ **Created:** [August 18, 2019, 10:39am UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642 "2019-08-18T10:39:53Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Elena\_Kaidrikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elena_kaidrikov/32/52093_2.png) [@Elena\_Kaidrikov](https://discuss.elastic.co/u/Elena_Kaidrikov)\ **Post date:** [August 18, 2019, 10:39am UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642/1 "2019-08-18T10:39:53Z")
Hello , Please help me to understand how to create a Visualization for netflow.application\_name . I don't see this field in the list on adding a new Visualization Thanks you for your help and support Elena ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [August 19, 2019, 5:02am UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642/2 "2019-08-19T05:02:32Z")
Hi @Elena_Kaidrikov, thanks for your question. Could you explain where exactly you expect your field to show up? If you create anew visualization you have to the select the index pattern you want to visualize first before configuring the actual chart. ---
**Author:** ![Elena\_Kaidrikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elena_kaidrikov/32/52093_2.png) [@Elena\_Kaidrikov](https://discuss.elastic.co/u/Elena_Kaidrikov)\ **Post date:** [August 19, 2019, 5:47am UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642/3 "2019-08-19T05:47:37Z")
> [@flash1293](#): > > thanks for your question. Could you explain where exactly you expect your field to show up? If you create a new visualization you have to the select the index pattern you want to visualize first before configuring the actual chart. Hi, When I create a new visualization for the Source port (for example ), I do the following steps : 1. Create new Visualization 2. select a visualization type ( Pie for example ) 3. choose a source ( netflow-\* ) 4. Add Buckets : -- Split slices -- Aggregation : Terms -- Field : netflow.src\_port 5. run But I can't create Visualization for the netflow.application\_name, because the field 's list doesn't contain it. If I open Discovery tab, I see the received netflow traffic with netflow.application\_name thanks you for your help ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [August 19, 2019, 6:25am UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642/4 "2019-08-19T06:25:13Z")
Hey, thanks for the additional info. A terms aggregation can only be applied to fields either indexed as keyword or having field data enabled (see [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html)). However if you are using the automatic mapping of Elasticsearch it should have created `netflow.application_name.keyword` for you which is the keyword-indexed version of `netflow.application_name`. Using this field in terms should yield the expected results. ---
**Author:** ![Elena\_Kaidrikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elena_kaidrikov/32/52093_2.png) [@Elena\_Kaidrikov](https://discuss.elastic.co/u/Elena_Kaidrikov)\ **Post date:** [August 19, 2019, 1:11pm UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642/5 "2019-08-19T13:11:32Z")
> [@flash1293](#): > > keyword-indexed version Hi, I am sorry. I didn't understand how I do this. I'm new to Kibana and Iā€™m struggling on a -maybe- simple thing šŸ˜Š I don't see `netflow.application\_name.keyword' in the list as well. I succeded to create Timelion Visualization : .es(index="netflow-_", metric="sum:netflow.packets", split="netflow.application\_name:30", kibana=true).scale\_interval(1s).fit(mode=scale).if(operator="lt", if=0, then=0).trim(start=2,end=1).label(regex="^._ netflow.application\_name:(.+) \> .\*$", label="$1").lines(width=1, stack=true, fill=0).yaxis(label="packets / sec", min=0) How can I create Pie Visualization? Thanks ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [August 20, 2019, 9:09am UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642/6 "2019-08-20T09:09:09Z")
The field you want to use in a terms aggregation should be of type keyword ([https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html)) You can check by retrieving the mapping in the dev console: `GET /netflow-*/_mapping`. It should include: ```auto "netflow.application_name": { "type": "keyword" } ``` By default, a string field is indexed as text _and_ as keyword in a separate `.keyword` field, this is why I asked about this. If it doesn't happen, the mapping has to be updated and existing data has to be-reindexed so `application_name` becomes a keyword field. ---
**Author:** ![Elena\_Kaidrikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elena_kaidrikov/32/52093_2.png) [@Elena\_Kaidrikov](https://discuss.elastic.co/u/Elena_Kaidrikov)\ **Post date:** [August 21, 2019, 5:33am UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642/7 "2019-08-21T05:33:45Z")
Thanks I've added and everything is working thanks you very much for your help and support ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 18, 2019, 5:33am UTC](https://discuss.elastic.co/t/kibana-visualization-for-netflow-application-name/195642/8 "2019-09-18T05:33:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.