# Adding field value changes as annotation events

**URL:** https://discuss.elastic.co/t/adding-field-value-changes-as-annotation-events/110742
**Category:** Kibana
**Created:** [December 7, 2017, 8:29pm UTC](https://discuss.elastic.co/t/adding-field-value-changes-as-annotation-events/110742 "2017-12-07T20:29:51Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![jeffkirk1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeffkirk1/32/8080_2.png) [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)
#### Post date: [December 7, 2017, 8:29pm UTC](https://discuss.elastic.co/t/adding-field-value-changes-as-annotation-events/110742/1 "2017-12-07T20:29:51Z")

</div>

Hey folks,

I want to be able to detect and annotate a time series visualization with an event when a specific value in a specific field changes value.

For example, I am tracking memory usage of a process, and I have a column which contains the PID of that process. When the memory usage grows too great, the process dies and is replaced by a new one with a smaller memory usage.

I'd like to be able to add an annotation line to my graph when the PID value changes, but not otherwise. I haven't had much luck figuring out how to define this using Kibana 5.4. (Can't quite upgrade to 6.x yet.)

Would appreciate any pointers. Thanks!

Jeff Kirk

---

<div class="post-metadata">

### Author: ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)
#### Post date: [December 12, 2017, 2:09pm UTC](https://discuss.elastic.co/t/adding-field-value-changes-as-annotation-events/110742/2 "2017-12-12T14:09:25Z")

</div>

Hey @jeffkirk1 the Time Series Visual Builder offers the ability to define annotations along with your time series data, but you'd want to create documents in an index for when the PID changes so that you can correlate them to your time series.

---

<div class="post-metadata">

### Author: ![jeffkirk1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeffkirk1/32/8080_2.png) [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)
#### Post date: [December 13, 2017, 9:37pm UTC](https://discuss.elastic.co/t/adding-field-value-changes-as-annotation-events/110742/3 "2017-12-13T21:37:19Z")

</div>

Hi Brandon,

Thanks, that's pretty much the same conclusion I came to after striking out everywhere else. 🙂

Jeff

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 10, 2018, 9:38pm UTC](https://discuss.elastic.co/t/adding-field-value-changes-as-annotation-events/110742/4 "2018-01-10T21:38:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
