new visualize type: sankey

[chenryn]

As @gthorsen commented in #3456 , I implement a sankey visualize type based on pie chart.

[elasticsearch-release]

Jenkins standing by to test this. If you aren't a maintainer, you can ignore this comment. Someone with commit access, please review this and clear it for Jenkins to run; then say 'jenkins, test it'.

[rashidkpc]

Can you elaborate on the enhancement here? Useful things include:

• screenshots - At least a handful
• documentation - a description of the diagram, how to use it, and when. Examples of datasets it makes sense for
• tests - this currently causes the tests to fail

[chenryn]

screenshot:

I use multi-layer pie chart to show functions' stack of php slowlog before, it's so great to checkout which request link is worst or changed. But, if one function name in different parent aggregations is the same, we can't merge them from other buckets in pie chart. So I think sankey chart maybe a good way to visualize.

And my screenshot above show another use case: clientip -> isp -> realserver.

Because I use sankey as a extension of multi-layer pie, so they could use the same dataset or testing of pie?

[chenryn]

@rashidkpc I add tests for sankey and now travis-ci check has passed. Anything more needed?

[rashidkpc]

Why can't we use min/max/avg here?

[chenryn]

Yes, we can. It just because the code base was copy from pie, and I used bucket.doc_count to process resp. The newest commit change to use metric.getValue(b) and now we can use min/max/avg here.

[rashidkpc]

What do the colors represent? This doesn't seem to be using our standard color generation system or legends?

[chenryn]

@rashidkpc I have change to use the standard color generation system now.
I think it's important to show the upstream and downstream terms on the sankey flow at the same time, so I show all terms on the chart and remove the legend. Is legend a required part?

[rashidkpc]

Thanks @chenryn, this has a lot of changes in it, and there's a lot of moving parts in the visualization system right now, so it will take some time to review. I'm going to put a hold on this right now while we sort out some of the vislib API questions

[ryanmaclean]

This has huge potential for access logs!

[juerkan]

i'm in telco business and we need this kind of graphs to analyse device traffic relationships in networks.
a big +1

[AlexIoannides]

+1 this would be very useful.

[zphj1987]

加油，这个图表很有用!

good job! i need sankey chart ,
@chenryn

[rashidkpc]

Now that things are bit more stable I think it would be reasonable to implement this as a plugin. I'd rather not merge it into upstream at this time

[chenryn]

@rashidkpc By now all the exists visType plugin examples are using TemplateVisType, but this PR use VislibVisType. Will the kibana dev team give some VislibVisType plugin example?

[vikramshinde12]

Hi Chenryn,
I have installed kbn_sankey_vis on our kibana server. In kibana status it shows that kbn_sankey_vis plugin is ready.
But I can not see sankey map under visualisation tab.
Please can you guide how to use this plugin to create a sankey diagram for user behaviour flow based on sample logs below

[2016-11-02 11:38:06] app.INFO: referer:Login Page, uri_path:Cancel Appointment Summary page, referralNumber : 000000018010 | sessionId : nhqnlqjqn3jidtnhm9he4kbuo5 [] []
[2016-11-02 11:38:12] app.INFO: referer:Cancel Appointment Summary page, uri_path:Cancellation Reason page, referralNumber : 000000018010 | sessionId : nhqnlqjqn3jidtnhm9he4kbuo5 [] []
[2016-11-02 11:38:20] app.INFO: referer:Cancellation Reason page, uri_path:Cancellation Confirmation page, referralNumber : 000000018010 | sessionId : nhqnlqjqn3jidtnhm9he4kbuo5 [] []

In the logs above, "referer" is "from url" and "uri_path" is the "to url"

Thank you in advance.

[shiv2202]

Hello,
Does it work with kibana 5.0.0 ?
Thanks

[vikramshinde12]

@chenryn @shiv2202
It worked on Kibana 4.4.2.

I have added "d3-plugins-sankey" plugin separately.

Thanks.

[imweijh]

looks very good. works on 5.x ?

[eligro91]

+1

[eligro91]

@rashidkpc what is needed to be done in order to merge this pull request?