I'm using ELK to store and graph Netflow data. I've created some line charts such as Flow over time, throughput over time, packets over time. What I need is to be able to compare data in a time range over days, weeks, or months.
For example, I want to see how many packets between 4pm and 5pm of today compared to yesterday or other previous days of the week, compare data of Monday to those of previous Monday of weeks.
The idea is to identify abnormal traffic based on Netflow throughput or packets over time. Let's say I'm looking at traffic for Thursday at 2pm. A high number of packets at 2pm does not necessarily mean an abnormal traffic if same number of packets occurred on Wednesday or Tuesday. A high value from the baseline is considered normal if it occurs during business hours or just because a program is scheduled to run at that time everyday or every weekday.
I wonder if Kibana has this feature or will support it in the future since it would be nice to create a baseline of data then identify the outliers