Annotations are an "event-based" feature, which it means that single events are taken into consideration to add an annotation: for instance, that is useful when you know something happened on 2022-07-15 at 13:00 and you want to annotate it on the chart.
In your case you want to apply an annotation based on a aggregation result, which is not something that is natively possible to do either on TSVB or Lens.
I think you have two options here:
-
preprocess your data and create documents/events on a different index/dataview for when your criteria is passed. At this point it would be possible to use TSDB/Lens annotations.
-
use an alternative representation, something like a bar chart in front of the area, with some formula tricks to isolate only where > 10
Yellow bars here are highlighting where
category.keyword > 10. -
Use another visualization entirely, like a table and color only cells where the sum of all categories > 10.
Define a custom palette for the
Count of recordsmetric with only 2 colors:Then declare a date histogram and then a
Top values of categories.keyword, which will be collapsed bysum:
The second one would be much easier to compute when conditionals will be available in Lens formula.