Hi Kibana Gurus,
I’m a hardcore network guy trying to learn Kibana from scratch, and I’m having a tough time.
In my Elasticsearch, I have a repository of network data. When in Kibana, I can see the data and all the individual fields; that’s a good sign. Included in that data are IP and MAC addresses:
Okay, great. But I notice that then I try to create a Visualization using these fields, they do not appear as options in the Fields drop-down menu. See the pict below, notice that while Packet.L3.Src appears in the above data set, it does not appear among the available fields for a visualization:
I assume this is a data type issue. In other words, when my data is imported into Elasticsearch, I’m guessing that the IP and MAC addresses are imported as strings, not properly-formatted IPs or MACs. I wish I knew for sure; I don’t know how to check data types in Elasticsearch/Kibana.
I don’t care how the data is formatted, and I may not have a way to convert data before it gets into Elasticsearch anyway. But I have to be able to produce visualizations using these fields, or all this network data is meaningless.
Has anyone seen an issue like this before? How could I make a chart with Packet.L3.Src and Packet.L3.Dst as columns? Any advice will be greatly appreciated.