Most visited domains (IPs)

Elastic Stack Logstash
1

Hello good people of the internet,
Firstly I know how FRUSTRATING it is to answer stupid questions regarding technical stuff however I am in charge of SOC for our company and we have just changed from SPLUNK to Kibana 7.

I will be very honest I am kinda lost and depressed as I can not find this information anywhere.

What do I need :
I have a proxy logstash. From this logstash I need to create a visualization(dashboard) of most visited IP addresses . The only thing I know at this moment is the fact the best visualization for that would be data table.

To sum up my questions :

  1. Is the task I want doable within the Kibana wizard (clicking) or do I have to put together a .json for this?
  2. On the left side I can only see "bucket" and "metrics" but where do I select the values that I want to be represented in the charts ?? (destination IP, hostname...)
  3. If you think this is too much questions, please PM me I am able pay if you are willing to discuss Kibana with me.

image
image1776×628 33.9 KB

I wish you good luck in using Kibana to all of you, sorry for this stupid topic I am just feeling completely destroyed by Splunk being replaced.
Have a nice day and thank you for your answers

2

If this is a kibana question rather than a logstash question then move it to that forum. If it is a logstash question you need to provide some detail about configuration, what the data formats look like, and what you want logstash to do.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.