Visualize count of unique documents

Elastic Stack Kibana
2

Instead of splitting the buckets, why not split the metric?

Sample data:

PUT discuss-170619
{
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 0
  },
  "mappings": {
    "_doc": {
      "properties": {
        "oip": {
          "type": "keyword"
        },
        "account": {
          "type": "keyword"
        }
      }
    }
  }
}

POST discuss-170619/_doc
{
  "oip": "10.172.16.1",
  "account": "foo@example.com"
}

POST discuss-170619/_doc
{
  "oip": "10.172.16.2",
  "account": "foo@example.com"
}

POST discuss-170619/_doc
{
  "oip": "10.172.16.3",
  "account": "foo@example.com"
}

POST discuss-170619/_doc
{
  "oip": "10.172.16.4",
  "account": "bar@example.com"
}

POST discuss-170619/_doc
{
  "oip": "10.172.16.4",
  "account": "bar@example.com"
}

POST discuss-170619/_doc
{
  "oip": "10.172.16.7",
  "account": "baz@example.com"
}

chrome_vQubKiBAIT
chrome_vQubKiBAIT.png1449×1151 78.7 KB

As an aside, why would it be considered not an issue if the invalid attempts are from the same IP? I would think that brute force attacks are mostly from the same IP and are rarely distributed for the same account name.

1 Like