# TSVB - How to use Annotations: display when a count of field LEVEL exceeds 500

**URL:** <https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812>\
**Category:** Kibana\
**Created:** [August 18, 2021, 11:02am UTC](https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812 "2021-08-18T11:02:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MWLonKso](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@MWLonKso](https://discuss.elastic.co/u/MWLonKso)\
**Post date:** [August 18, 2021, 11:02am UTC](https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812/1 "2021-08-18T11:02:05Z")

</div>

Hi there. The premise is pretty simple. I'm counting Events that match one of four possible values for a field called Level. In the TSVB I've split the graph using filters. What I'd like to be able to do is to put an Annotation on there when a count of Level exceeds a particular value (let's say 500, for the sake of argument). If someone could point me at a KQL expression that would do this I would find that incredibly useful.

Thanks in advance  
Marcus

---

<div class="post-metadata">

**Author:** ![Marta\_Bondyra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marta_bondyra/32/102122_2.png) [@Marta\_Bondyra](https://discuss.elastic.co/u/Marta_Bondyra)\
**Post date:** [September 7, 2021, 9:26am UTC](https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812/2 "2021-09-07T09:26:47Z")

</div>

Hi @MWLonKso ,

unfortunately I don't think it's possible. Annotations work on single documents and not on aggregated data. What you could do is to count these events before or while ingesting the data to ES and add a field to your document that represents the number of events that occured, eg. `event_0_counter`. Then use simple KQL: `event_0_counter : 500`. This is the only workaround that comes to my mind, sorry about these limitations.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2021, 9:27am UTC](https://discuss.elastic.co/t/tsvb-how-to-use-annotations-display-when-a-count-of-field-level-exceeds-500/281812/3 "2021-10-05T09:27:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.