Mapping geoIP connections in Kibana?

Elastic Stack Kibana
1

I've found tutorials on how to map lat/long data on Kibana maps. I have not been able to find anything on how to map connections between those Geolocation points.

My use case is to map GeoIP network packet flows that I've picked up from netflow and have enriched in Logstash using a MaxMind database.

I've found many Tableau tutorials such as https://onlinehelp.tableau.com/current/pro/desktop/en-us/maps_howto_origin_destination.htm but nothing for Elastic/Kibana.

2

@thomasneirynck - any helpful hints here ? I haven't played around with maps- lat/long data on Kibana maps much.

Thanks
Rashmi

3

Any help would be great! I can't even get basic IP enrichment working. Logstash geoip filter error: _geoip_lookup_failure

4

hi @sgreszcz,

mapping connections in the way you describe is currently not supported in Kibana. I'd suggest you create a new feature request: https://github.com/elastic/kibana/issues/new

the team is working on a new geo-solution, so it would be good to bring this on their radar. that new solution will support mapping geo_shapes, so if your to-and-from point are stored as a LineString with two points, that upcoming solution will help you map those connections.

For the geo-ip plugin, I would post this in the logstash forum: https://discuss.elastic.co/c/logstash

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.