# Netflow Traffic Volume by Avg Bits/s

**URL:** <https://discuss.elastic.co/t/netflow-traffic-volume-by-avg-bits-s/134520>\
**Category:** Kibana\
**Created:** [June 5, 2018, 5:24am UTC](https://discuss.elastic.co/t/netflow-traffic-volume-by-avg-bits-s/134520 "2018-06-05T05:24:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![venki522](https://avatars.discourse-cdn.com/v4/letter/v/90db22/32.png) [@venki522](https://discuss.elastic.co/u/venki522)\
**Post date:** [June 5, 2018, 5:24am UTC](https://discuss.elastic.co/t/netflow-traffic-volume-by-avg-bits-s/134520/1 "2018-06-05T05:24:19Z")

</div>

Hi,

Iam trying to create a dashboard in kibana for netflow where i need traffic volume by Avg Bits/s so that i can monitor the traffic volume.

in case of DDOS where the traffic volume is huge,i should be able to see that traffic volume in kibana

is there a way to configure the dashboard to achieve this.any help is much appreciated.thanks

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [June 5, 2018, 5:51pm UTC](https://discuss.elastic.co/t/netflow-traffic-volume-by-avg-bits-s/134520/2 "2018-06-05T17:51:56Z")

</div>

Hey @venki522, you can do this using a derivative of the cumulative sum of the sum of netflow.bytes on a date histogram bucketed by second. The following screenshot will hopefully guide you down the right path:

![16%20PM](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b40e3027a10201219ef0532dd791a3a0b1a86e49.png)

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [June 5, 2018, 5:52pm UTC](https://discuss.elastic.co/t/netflow-traffic-volume-by-avg-bits-s/134520/3 "2018-06-05T17:52:57Z")

</div>

Also, take a look at the Dashboards that are created by the Logstash Netflow module when using the `--setup` flag [https://www.elastic.co/guide/en/logstash/current/netflow-module.html](https://www.elastic.co/guide/en/logstash/current/netflow-module.html)

---

<div class="post-metadata">

**Author:** ![venki522](https://avatars.discourse-cdn.com/v4/letter/v/90db22/32.png) [@venki522](https://discuss.elastic.co/u/venki522)\
**Post date:** [June 6, 2018, 6:34am UTC](https://discuss.elastic.co/t/netflow-traffic-volume-by-avg-bits-s/134520/4 "2018-06-06T06:34:45Z")

</div>

Thank you Brandon for the reply.So netflow.bytes has both in\_bytes and out\_bytes since i dont see those fields in the netflow packet.

when i don the above my y-axis has got very big number and even minus.could i reduce it to shorter one and readable one.

moreover this is only on one index,how can i make this as graph a live one meaning the graph should show the volume in real time  
thanks for the reply once again

![image](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc0d3386157acd2cfbff9ef661d5172e83385c6c.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 4, 2018, 6:34am UTC](https://discuss.elastic.co/t/netflow-traffic-volume-by-avg-bits-s/134520/5 "2018-07-04T06:34:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.