Query configuration in annotation in TSVB visual

[Seemant_Bind]

Hi,

I wanted to create a visual in TSVB to display Bell icon when total count of category exceeds particular threshold. I have tried category.keyword.count>10 (referring to this creating a trend graph based on tsvb + adding annotations - YouTube) but it is not working. See the screenshot for the configuration.
Also, is there any other visual to achieve the same?

[Marco_Liberati]

Hi @Seemant_Bind

Annotations are an "event-based" feature, which it means that single events are taken into consideration to add an annotation: for instance, that is useful when you know something happened on 2022-07-15 at 13:00 and you want to annotate it on the chart.

In your case you want to apply an annotation based on a aggregation result, which is not something that is natively possible to do either on TSVB or Lens.
I think you have two options here:

• preprocess your data and create documents/events on a different index/dataview for when your criteria is passed. At this point it would be possible to use TSDB/Lens annotations.

• use an alternative representation, something like a bar chart in front of the area, with some formula tricks to isolate only where > 10

  

  Yellow bars here are highlighting where category.keyword > 10.

• Use another visualization entirely, like a table and color only cells where the sum of all categories > 10.

  Define a custom palette for the Count of records metric with only 2 colors:

  

  Then declare a date histogram and then a Top values of categories.keyword, which will be collapsed by sum:

  
  

The second one would be much easier to compute when conditionals will be available in Lens formula.