# Netflow - SUM netflow.bytes between 2 ip's **URL:** \ **Category:** Kibana\ **Created:** [July 19, 2019, 2:01pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409 "2019-07-19T14:01:38Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![rjpetrin](https://avatars.discourse-cdn.com/v4/letter/r/c89c15/32.png) [@rjpetrin](https://discuss.elastic.co/u/rjpetrin)\ **Post date:** [July 19, 2019, 2:01pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409/1 "2019-07-19T14:01:39Z")
Hi All, I'm using ELK 7.1 and Netflow v.5 to gather and visualize Netflow data in our environment. All features and dashboards are working correctly. However I'm trying to create a graph that displays the bandwidth being used between 2 ip address (BOVPN). Can somebody help me with the KQL code? Thank you very much ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [July 19, 2019, 8:36pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409/2 "2019-07-19T20:36:30Z")
I'm not familiar with the Netflow module, could you help me understand what the documents look like? Does each individual document have some sort of bandwidth field? Do you just want to add together the bandwidth use of two specific ip addresses? ---
**Author:** ![rjpetrin](https://avatars.discourse-cdn.com/v4/letter/r/c89c15/32.png) [@rjpetrin](https://discuss.elastic.co/u/rjpetrin)\ **Post date:** [July 22, 2019, 1:21pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409/3 "2019-07-22T13:21:57Z")
Hello Bargs, first of all thank your for your time and attention on it. I'd like to sum the total bytes transferred between 2 ip's (they're my BOVPN gateway). Netflow has a few fields related to the flow and a few fields related to the geoip. here are the netflow fields. indent preformatted text by 4 spaces |netflow.bytes|616| |netflow.direction|ingress| |netflow.dst\_addr|1.1.1.1| |netflow.dst\_as|0| |netflow.dst\_locality|public| |netflow.dst\_mask\_len|0| |netflow.dst\_port|60433| |netflow.dst\_port\_name|TCP/60433| |netflow.engine\_id|0| |netflow.engine\_type|0| |netflow.first\_switched|Jul 20, 2019 @ 12:15:07.836| |netflow.flow\_locality|public| |netflow.flow\_records|30| |netflow.flow\_seq\_num|14,553,060| |netflow.input\_snmp|10| |netflow.ip\_version|IPv4| |netflow.last\_switched|Jul 20, 2019 @ 12:15:07.944| |netflow.next\_hop|0.0.0.0| |netflow.output\_snmp|65535| |netflow.packets|5| |netflow.protocol|6| |netflow.protocol\_name|TCP| |netflow.sampling\_algorithm|0| |netflow.sampling\_interval|0| |netflow.src\_addr|2.2.2.2| |netflow.src\_as|0| |netflow.src\_locality|public| |netflow.src\_mask\_len|0| |netflow.src\_port|443| |netflow.src\_port\_name|TCP/443 (https)| |netflow.tcp\_flag\_tags|PSH, ACK| |netflow.tcp\_flags|24| |netflow.tcp\_flags\_label|PSH-ACK| |netflow.tos|0| |netflow.version|Netflow v5| |tags|\_geoip\_lookup\_failure| |type|netflow| thank you ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [July 22, 2019, 11:04pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409/4 "2019-07-22T23:04:40Z")
I feel like I might not be fully understanding your request, but if you just want to match docs that are going from one particular IP to another, you could just do: `netflow.src_addr:2.2.2.2 and netflow.dst_addr:1.1.1.1` ---
**Author:** ![rjpetrin](https://avatars.discourse-cdn.com/v4/letter/r/c89c15/32.png) [@rjpetrin](https://discuss.elastic.co/u/rjpetrin)\ **Post date:** [July 23, 2019, 6:14pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409/5 "2019-07-23T18:14:21Z")
Hello Bargs, Sorry if I wasn't clear on my question. What I'd like to have is a graph to monitor our Branch Office VPN that is connected between our main office (IP: 1.1.1.1) and our DR (IP:2.2.2.2). I'd like to see one graph like this but instead of flow records, I'd like to see it in bytes. By the way, I'm running ELK 7.2. Thank you very much for your attention ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9ac749932b8a17379ddc3a1f1bd312f1cda30d24.png) ---
**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\ **Post date:** [July 24, 2019, 8:43pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409/6 "2019-07-24T20:43:15Z")
I think a vis with the following configuration would give you what you want: ![58%20PM](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3ed06daaa9f81d21b3ee11ff93bdede9de3c64bf.png) ---
**Author:** ![rjpetrin](https://avatars.discourse-cdn.com/v4/letter/r/c89c15/32.png) [@rjpetrin](https://discuss.elastic.co/u/rjpetrin)\ **Post date:** [July 25, 2019, 5:20pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409/7 "2019-07-25T17:20:55Z")
Bargs, That worked perfectly. Thank you very much for all your help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 22, 2019, 5:20pm UTC](https://discuss.elastic.co/t/netflow-sum-netflow-bytes-between-2-ips/191409/8 "2019-08-22T17:20:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.