1

I am trying to display netflow in sankey diagram with Kibana. In Kibana 6.X and Elasticsearch 6.4 I can use the method described in Sankey Vega Tutorial

Now I want to achieve the same result with Kibana 5.6 and Elasticsearch 5.X. so I have installed the Vis Kibana plugin. The problem is with the query aggregation.

In Elastic 6 I can do:

GET logstash-*/_search {   "size": 0,   "aggs": {
"table": {
  "composite": {
    "size": 10,
    "sources": [
      {"stk1": {"terms": {"field": "srcip.keyword"}}},
      {"stk2": {"terms": {"field": "dstip.keyword"}}}
    ]
  }
}   } }

Composite aggregation is still in beta and not available in 5.X. So I'm looking for a way to achieve the same/similar usable result in 5.X.

J91321
  • 697
  • 1
  • 7
  • 19

0 Answers0