Data exploration and visualisation for Elasticsearch and Splunk.
Go Shell
Switch branches/tags
Nothing to show
Fetching latest commit…
Cannot retrieve the latest commit at this time.

Marija Gitter Go Report Card Docker pulls Build Status

Marija is a data exploration and visualisation tool for (un)structured Elasticsearch data. Using Marija you'll be able to see relations between data of different datasources without any modifications to your data or index.

Currently Marija is being used to identify related spamruns, but can be used for all kind of different data sets.

Enron Demo



Using Docker

$ docker pull marija/marija
$ vim config-docker.toml # update elasticsearch configuration
$ docker run -d -p 8080:8080 -v $(pwd)/config-docker.toml:/config/config.toml --name marija marija/marija

Installation from source

Install Golang

If you do not have a working Golang environment setup please follow Golang Installation Guide.

Install Marija

Installation of Marija is easy.

$ go get
$ marija

Installation using Homebrew (macOS)

$ brew tap dutchcoders/homebrew-marija
$ brew install marija




output = "stdout"
level = "debug"





  • work on multiple servers and indexes at the same time
  • different fields can be used as node identifier
  • identifiers can be normalized through normalization regular expressions
  • each field will have its own icon
  • query indexes natively to the datasource
  • histogram view to identify nodes in time
  • select and delete nodes
  • select related nodes, deselect all but selected nodes
  • zoom and move nodes
  • navigate through selected data using the tableview
  • multiple datasources supported like Elasticsearch, Splunk,, Twitter
  • submit nodes in realtime

Contribute to Marija

Please follow Marija Contributor's Guide

Copyright and license

Code and documentation copyright 2016-2018 Remco Verhoef.

Code released under the Apache license.