# Sankey Charts - Using IP addresses
**URL:** https://discuss.elastic.co/t/sankey-charts-using-ip-addresses/163069
**Category:** Kibana
**Created:** [January 6, 2019, 11:12am UTC](https://discuss.elastic.co/t/sankey-charts-using-ip-addresses/163069 "2019-01-06T11:12:54Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@nsheridan](https://discuss.elastic.co/u/nsheridan)
#### Post date: [January 6, 2019, 11:12am UTC](https://discuss.elastic.co/t/sankey-charts-using-ip-addresses/163069/1 "2019-01-06T11:12:54Z")
Hi Forum,
I am completely new to lab visualisations, and I have seen Sankey Charts and they struck me as particulary useful for charting IP address pairing for flows from DDoS mitigation appliances (I get better information from elastic than I get from their own management software).
I use grok filters to break up the syslog messages (filebeat to logstash) into src\_ip and dst\_ip, but hoping I could hack the original canned demo by changing this:
```
sources: [
{
stk1: {
terms: {field: "geo.src"}
}
}
{
stk2: {
terms: {field: "geo.dest"}
}
}
]
```
to this:
```
sources: [
{
stk1: {
terms: {field: "src_ip.keyword"}
}
}
{
stk2: {
terms: {field: "dst_ip.keyword"}
}
}
]
```
Shows no data. Can anyone point me in the right direction?
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [January 7, 2019, 11:42am UTC](https://discuss.elastic.co/t/sankey-charts-using-ip-addresses/163069/2 "2019-01-07T11:42:26Z")
can you make sure that the timefield and index are also set OK in the Vega code?
```auto
url: {
%context%: true
%timefield%: @timestamp
index: logstash-*
```
---
### Author:  [@nsheridan](https://discuss.elastic.co/u/nsheridan)
#### Post date: [January 7, 2019, 6:55pm UTC](https://discuss.elastic.co/t/sankey-charts-using-ip-addresses/163069/3 "2019-01-07T18:55:47Z")
Hi Marius,
Thanks! my index is filebeat so I had that as filebeat-\*, but I think the problem I had (that you pointed out) was that I had
```
url: {
%context%: true
%timefield%: timestamp
index: filebeat*
```
and I added the @timestamp as you suggested
```
url: {
%context%: true
%timefield%: @timestamp
index: filebeat*
```
After that... BOOM! Thanks 😃
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [January 8, 2019, 10:25am UTC](https://discuss.elastic.co/t/sankey-charts-using-ip-addresses/163069/4 "2019-01-08T10:25:26Z")
Awesome, glad it helped.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 5, 2019, 10:32am UTC](https://discuss.elastic.co/t/sankey-charts-using-ip-addresses/163069/5 "2019-02-05T10:32:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.