Flow graphs (Sankey visualization)

[Asimov4]

I would like to use ELK to analyze user navigation patterns (ala Apache Access logs) and wondering if a User Flow graph similar to Google Analytics could be added as a visualization.

I have not quite figured out the document structure that could power that yet but I imagine that each document would be a session and it could maybe have 6 fields for the 1st visited page, 2nd visited page and so on...

Here's a sample User Flow graph from google analytics:

[pemontto]

👍

[bertol83]

+1

[elvarb]

Same could be used to show relationships in firewall logs.

Three "panes"

Left, incoming connections
Middle, the ip being viewed
Right, outgoing connections

I think the big problem to solve is how to create a generic visualization that can be used with different types of data.

But, Packetbeat used to have a panel sort of like that for Kibana 3

[juerkan]

+1

[Crazyigor1987]

https://github.com/chenryn/kbn_sankey_vis

[tbragin]

via @JalehD

This is a request for making snakey diagrams available in kibana visualizations , there is this thirdparty plugin for kibana 4 https://github.com/chenryn/kbn_sankey_vis but it'll be best to have this as part of kibana visualisations.

This kind of visualization is useful for example to show what an average user visit looks like on a given website or to show the data flow between various applications from those applications log data.

[markwalkom]

https://github.com/james-irwin/enronsankey/ has some sample code we could use?

[FraJern]

+1

[ubhackn]

+1

[jx-nimblerx]

++

[eligro91]

+1

[LeonAgmonNacht]

+1

[colmex]

+1

[plumpNation]

+1

[DavidFlamini]

+1

[pemontto]

You can now do this with Vega. If you haven't already, check out this blog post by @nyurik. You'll need Kibana 6.2+

[albertosatec]

There are any deadline for this issue?
We try to do with vega but in our case they don´t work because we need dinamic filter in the visualization.

[IanLee1521]

Coming from Splunk where they have this available, I'll add that the Vega implementation seems WAY more convoluted than doing this over there, which boils down to using a simple query like this and passing it to the sankey visualization type:

... | stats <stats_function>(<size_field>) [<stats_function>(<color_field>)] by <source_category_field> <target_category_field>

ref: https://docs.splunk.com/Documentation/SankeyDiagram/1.6.0/SankeyDiagramViz/SankeySearchDataFormat

[timductive]

Closing this because it's not planned to be resolved in the foreseeable future. It will be tracked in our Icebox and will be re-opened if our priorities change. Feel free to re-open if you think it should be melted sooner.

[Erikg346]

+1
This still needed