marija's Introduction

Marija

Marija is a data exploration and visualisation tool for (un)structured Elasticsearch data. Using Marija you'll be able to see relations between data of different datasources without any modifications to your data or index.

Currently Marija is being used to identify related spamruns, but can be used for all kind of different data sets.

Enron Demo

Screenshot

Install

Using Docker

$ docker pull marija/marija
$ vim config-docker.toml # update elasticsearch configuration
$ docker run -d -p 8080:8080 -v $(pwd)/config-docker.toml:/config/config.toml --name marija marija/marija

Installation from source

Install Golang

If you do not have a working Golang environment setup please follow Golang Installation Guide.

Install Marija

Installation of Marija is easy.

$ go get github.com/dutchcoders/marija
$ marija

Installation using Homebrew (macOS)

$ brew tap dutchcoders/homebrew-marija
$ brew install marija

Configuration

[datasource]

[datasource.elasticsearch]
type="elasticsearch"
url="http://127.0.0.1:9200/demo_index"
#username=
#password=

[[logging]]
output = "stdout"
level = "debug"

Splunk

[datasource]

[datasource.splunk]
type="splunk"
url="https://localhost:8089"
username="admin"
password="admin"

Features

work on multiple servers and indexes at the same time
different fields can be used as node identifier
identifiers can be normalized through normalization regular expressions
each field will have its own icon
query indexes natively to the datasource
histogram view to identify nodes in time
select and delete nodes
select related nodes, deselect all but selected nodes
zoom and move nodes
navigate through selected data using the tableview
multiple datasources supported like Elasticsearch, Splunk, Blockchain.info, Twitter
submit nodes in realtime