# Timelion - How to calculate and viszualize " Mbps " using netflow data **URL:** \ **Category:** Kibana\ **Tags:** timelion\ **Created:** [December 28, 2017, 6:04am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395 "2017-12-28T06:04:02Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\ **Post date:** [December 28, 2017, 6:04am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/1 "2017-12-28T06:04:02Z")
Hi All, Currently am using Logstash , Elasticsearch & Kibana to gather and visualize Netflow data from few of our gateway routers. With Netflow data am receiving " netflow.in\_bytes " filed which contains the bytes of data. I was trying to put that data in to a timelion and using the following function to calculate the Mbps. But the output am getting is not accurate. Can anyone advise me on this ? > Blockquote > _.es(timefield=@timestamp, metric=sum:netflow.in\_bytes).derivative().multiply(8).divide(1048576).divide(60).lines(fill=2, width=1).color(green).label("Inbound traffic").title("Network traffic (MB/s)")_ ---
**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\ **Post date:** [December 28, 2017, 4:39pm UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/2 "2017-12-28T16:39:26Z")
Any help ? ---
**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\ **Post date:** [December 29, 2017, 4:54am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/3 "2017-12-29T04:54:29Z")
If you are starting with bytes, you just need to divide by 1000000 to get megabytes. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 29, 2017, 5:10am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/4 "2017-12-29T05:10:09Z")
In what way is the result not accurate? When I have calculated volume per second I have not used the 'derivative' funktion and have replaced 'divide(60)' by the 'scale\_interval' function, which can adapt to changing aggregation intervals, as described [in this thread](https://discuss.elastic.co/t/how-to-find-bandwidth-usage-from-netflow-data/62005/8). ---
**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\ **Post date:** [December 29, 2017, 6:28am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/5 "2017-12-29T06:28:29Z")
Thanks tyler, converting in to MB can be done using devide() function. But by using "netflow.in\_bytes" the out come is not accurate . ---
**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\ **Post date:** [December 29, 2017, 6:34am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/6 "2017-12-29T06:34:56Z")
Dear Christian, Thanks for the update!!! I have tried the function mentioned in that thread but the out come is not accurate. > Blockquote > .es(index=logstash\*, metric='sum:bytes').divide(1048576).scale\_interval('1s').title('MB per second') I have used the it as below. > Blockquote > .es(index=logstash\*, metric='sum:netflow.in\_bytes').divide(1048576).scale\_interval('1s').title('MB per second') ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 29, 2017, 9:20am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/7 "2017-12-29T09:20:17Z")
In what way is it not accurate? What are you comparing it to? ---
**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\ **Post date:** [January 4, 2018, 6:01am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/9 "2018-01-04T06:01:48Z")
Sorry for the late reply !!! Following is my timelion function. Am collecting Netflow data from few sources and I want to calculate the Bandwidth usage ( MBps ) subnet wise. > Blockquote > .es(index=logstash\*, metric='sum:netflow.in\_bytes').divide(1048576).scale\_interval('1s').title('MB per second') ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 4, 2018, 6:22am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/10 "2018-01-04T06:22:23Z")
That does not really answer any of the questions I asked, so I am not sure how I can help further. ---
**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\ **Post date:** [January 4, 2018, 9:23am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/11 "2018-01-04T09:23:56Z")
Sorry !!! It's like this , I want to know the usage ( MBps ) of a subnet ( eg: 192.168.0.0/24 ). This subnet is devided in to /29's and given to some other devices. I have a CACTI system which will record the individual usage of devices. When I apply the above timelion function the output I get is not even approximately close to what I see in CACTI. Please let me know any other info you needed. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 4, 2018, 9:59am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/12 "2018-01-04T09:59:47Z")
Is your CACTI system based on the same data you are recording in Elasticsearch? Is the granularity the same? ---
**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\ **Post date:** [January 4, 2018, 11:54am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/13 "2018-01-04T11:54:40Z")
No it collect data via SNMP. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 4, 2018, 12:10pm UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/14 "2018-01-04T12:10:15Z")
How large is the difference? Does it shrink if you average out over a longer period? Are you able to see if the raw data used contain the same data? ---
**Author:** ![Methsri\_Wickramarath](https://avatars.discourse-cdn.com/v4/letter/m/90ced4/32.png) [@Methsri\_Wickramarath](https://discuss.elastic.co/u/Methsri_Wickramarath)\ **Post date:** [January 5, 2018, 8:39am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/15 "2018-01-05T08:39:18Z")
Am checking it for a 15min window. Both systems showing totally different values. CACTI system normally closed to actual usage of that device. on the the other hand Timelion showing irrelevant info. Am not think it's shrink or anything.... I didn't get the last question , can you explain how I can check it ? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [January 5, 2018, 8:54am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/16 "2018-01-05T08:54:43Z")
I do not know how you would check the underlying data in your CACTI system and compare this to the data reported to Elasticsearch. Can you show us what the data looks like and how large the difference is? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 2, 2018, 8:55am UTC](https://discuss.elastic.co/t/timelion-how-to-calculate-and-viszualize-mbps-using-netflow-data/113395/17 "2018-02-02T08:55:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.