Newbie playing with netflow (with nProbe) + ELK. Everything running and now what

Elastic Stack Kibana
1

Hello,

Just bought a UBNT router with netflow capabilities.

I setup netflow, and configured a windows server with ELK.

http://www.secureict.info/2015/11/process-netflow-with-nprobe-and.html
http://www.secureict.info/2015/11/process-netflow-with-nprobe-and_13.html
http://www.secureict.info/2015/11/process-netflow-with-nprobe-and_91.html

Now I see a basic graph on kibana, but I want

  • an historical view
  • of my IP adresses (maybe with hostnames)
  • and their bandwidth usage

to answer my question: "wich of my clients consumes howmuch bandwith on what time" Granularity of period should at least be 1h.

Is this possible?
Can somebody point me to some good information (not to difficult for a newbie as me... :slight_smile: )

thanx in advance!
Bart

2

Which will be possible when you have more data.

That should already show up, hostnames will depend on reverse DNS.

That's where you run an aggregation.

Did you run through the second one of those links?