Sankey visualization


This is an example of how to build an sankey visualization using the vega visualization in Kibana. This vega example has three versions of the sankey visualization. Its an 2 Level, 4 Level and 7 Level example. A Sankey visualization is a great way to show the movement of users through your application. It can also be used for any other kind of data representation that is based on multiple levels and each level has an defined start and ending point.

A Sankey chart is a kind of stream chart with the width of the lines shown relatively to the stream amount. Every passage in the example information has source and objective nation code. The chart will have two modes: all-to-all (default), in addition to it will permit clients to choose either the source or the objective nation, and show just related traffic.


This download is not able to run immediately. But its easy to adapt to your needs. You only need to change the index to search in and also the fields that contain the source and the destination information.

Make sure source and destination contain similar values to make it work.


If you wanna learn more about that check this blog which is the source for that example:

Tested versions
ECS compliant
Category , ,

You must log in to submit a review.

Related downloads

Make Logstash a REST endpoint that executes scripts or manually adds data in Elasticsearch.

A vega visualization that shows the connection between resource group, resource type and the resource itself based on Elastic agent azure billing data integration.

A collection of rules based on the Sigma rules for AWS based on the Filebeat AWS module and Elastic agent integration.

A collection of rules based on the Sigma detection rules for proxy server and web server looks, e.g. zeek or suricata.

This is a working clock visualization in UTC time.

Logstash Pipeline to load Meraki logs via Syslog into Elasticsearch

These downloads could be also interesting for you

This is a playable version of pacman made with Vega.

ACSC Advisory IOCs detection rules for Elastic SIEM

Vega example to show GitHub commits per author per hour of day.

This bundle enhances the Kibana alerting experience. Storing all relevant information in indices and visualize the data in dashboards.

Dashboard to monitor GCP resources using different metrics and logs.

A collection of rules based on the Sigma rules for Zeek based on the Filebeat Zeek module.