This seems to be an often requested upstream issue, so we may just have to wait for them to figure it out, but if we had a javascript hacker that was willing to take a shot at it and upstream the results we would probably make a lot of friends.

See also: https://github.com/torkelo/grafana which is apparently a fork of kibana designed to query logstash.

We are now annotating based on scap log events that are sent to logstash. This is probably good enough for now, but it could be better.