# Visualization of IPs based on hit amount

**URL:** <https://discuss.elastic.co/t/visualization-of-ips-based-on-hit-amount/164131>\
**Category:** Kibana\
**Created:** [January 14, 2019, 11:43am UTC](https://discuss.elastic.co/t/visualization-of-ips-based-on-hit-amount/164131 "2019-01-14T11:43:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![steven.walsh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steven.walsh/32/35674_2.png) [@steven.walsh](https://discuss.elastic.co/u/steven.walsh)\
**Post date:** [January 14, 2019, 11:43am UTC](https://discuss.elastic.co/t/visualization-of-ips-based-on-hit-amount/164131/1 "2019-01-14T11:43:40Z")

</div>

Hello all,

We're currently experiencing an issue on the sites we manage were web-scrapers are coming in and increasing our traffic. We have software for this but they are circumventing this by hitting the site once or twice and then changing IPS, so the third party software we use can't identify them in time. There's work there to resolve that but that's another topic.

I want to create a visualization to display the number of IP addresses with a certain amount of hits, say less than 5, between 5-15 etc. but I just can't get it displaying correctly. Having hits less than 5 is unusual for our sites so we'd like to build on this data and maybe create a watcher or some such for future notification.

We're using apache logs for this and we have what I think is standard enough. If more specific information on our solution is required let me know. Thanks in advance

---

<div class="post-metadata">

**Author:** ![jen-huang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jen-huang/32/74327_2.png) [@jen-huang](https://discuss.elastic.co/u/jen-huang)\
**Post date:** [January 15, 2019, 2:05am UTC](https://discuss.elastic.co/t/visualization-of-ips-based-on-hit-amount/164131/2 "2019-01-15T02:05:42Z")

</div>

Could you provide some example logs of your hits?

---

<div class="post-metadata">

**Author:** ![steven.walsh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steven.walsh/32/35674_2.png) [@steven.walsh](https://discuss.elastic.co/u/steven.walsh)\
**Post date:** [January 17, 2019, 10:45am UTC](https://discuss.elastic.co/t/visualization-of-ips-based-on-hit-amount/164131/3 "2019-01-17T10:45:22Z")

</div>

Hi Jen, sorry on the delay. Example below of the field data for each log event, hope that's enough to go on

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/1/81fd202ff5d83508d8fc04bf0dd8696dce7aa2b2.png)

So I know in my head what to do; add the number of hits for each individual geoip.ip field, if total less than 5 add that to one section of visualization, if total between 5-15 add to another and so on. Still just can't get that out on to the screen 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2019, 10:45am UTC](https://discuss.elastic.co/t/visualization-of-ips-based-on-hit-amount/164131/4 "2019-02-14T10:45:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.