I am using TSVB to visualize the data stored in the machine learning index, I have seen that I can use annotations to visualize the details of the anomaly but when I try to add the causes.typical field it does not generate the annotations in the visualization.
These is an array of causes so I think that using causes.typical won't address any field from there. It would have to be something like causes.typical You can try with an without the  for typical. I do have doubts that this is a supported scenario, so if you come back and say that it doesn't work like that for you, then I'll open an issue for it in the Kibana repo.
@Oskr - A possible workaround could be the usage of Transforms. In particular, you could use Transforms to re-format the .ml-anomalies-* index into a new, very small index for reporting purposes for TSVB. For example:
@Oskr - I'm not sure @flash1293 's solution works specifically with the .ml-anomalies-* index because the way that it is mapped., but we can wait on his clarification (I couldn't get his suggestion to work either). I suspect his test didn't actually use the true .ml-anomalies-* index, but rather a mock-up.
My workaround using Transforms will be incredibly lightweight. Transforms just uses elasticsearch aggregations under the hood and the .ml-anomalies-* index that it is operating on shouldn't be that big in the first place!
I'm no ML expert, maybe something special is going on there. TSVB is simply reading the _source from the document, so if the source is available, is should work. Maybe ml anomalies are not storing this part of the source?
The part I'm sure about is the mustache syntax for accessing the first value of an array is path. (not path.0 or path which would make more sense)
It turns out this is exactly the situation. The causes array in _source with a mapping type of nested messes up TSVB - as TSVB executes an exists filter on the data:
which returns nothing.
For now, stick with the transforms workaround. There could also be a possibility of also using a runtime field for items buried in the causes array but I have yet to test that (and perhaps TSVB doesn't support runtime fields until 7.13)