Netflow - SUM netflow.bytes between 2 ip's

rjpetrin · July 19, 2019, 2:01pm

Hi All,
I'm using ELK 7.1 and Netflow v.5 to gather and visualize Netflow data in our environment. All features and dashboards are working correctly. However I'm trying to create a graph that displays the bandwidth being used between 2 ip address (BOVPN). Can somebody help me with the KQL code?
Thank you very much

Bargs · July 19, 2019, 8:36pm

I'm not familiar with the Netflow module, could you help me understand what the documents look like? Does each individual document have some sort of bandwidth field? Do you just want to add together the bandwidth use of two specific ip addresses?

rjpetrin · July 22, 2019, 1:21pm

thank you

Bargs · July 22, 2019, 11:04pm

I feel like I might not be fully understanding your request, but if you just want to match docs that are going from one particular IP to another, you could just do:

netflow.src_addr:2.2.2.2 and netflow.dst_addr:1.1.1.1

rjpetrin · July 23, 2019, 6:14pm

Hello Bargs,
Sorry if I wasn't clear on my question. What I'd like to have is a graph to monitor our Branch Office VPN that is connected between our main office (IP: 1.1.1.1) and our DR (IP:2.2.2.2). I'd like to see one graph like this but instead of flow records, I'd like to see it in bytes. By the way, I'm running ELK 7.2.
Thank you very much for your attention

Bargs · July 24, 2019, 8:43pm

I think a vis with the following configuration would give you what you want:

rjpetrin · July 25, 2019, 5:20pm

Bargs,
That worked perfectly.
Thank you very much for all your help.

system · August 22, 2019, 5:20pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.