ES|QL CHANGE_POINT command

CHANGE_POINT detects spikes, dips, and change points in a metric.

CHANGE_POINT value [ON key] [AS type_name, pvalue_name]
		

CHANGE_POINT value [ON key] [AS type_name, pvalue_name] [BY grouping_expression1[, ..., grouping_expressionN]]
		

value

The column with the metric in which you want to detect a change point.

key

The column with the key to order the values by. If not specified, @timestamp is used.

group

The column to group values by. When specified, change point detection is performed independently for each group.

type_name

The name of the output column with the change point type. If not specified, type is used.

pvalue_name

The name of the output column with the p-value that indicates how extreme the change point is. If not specified, pvalue is used.

CHANGE_POINT detects spikes, dips, and change points in a metric. The command adds columns to the table with the change point type and p-value, that indicates how extreme the change point is (lower values indicate greater changes).

The possible change point types are:

• dip: a significant dip occurs at this change point
• distribution_change: the overall distribution of the values has changed significantly
• spike: a significant spike occurs at this point
• step_change: the change indicates a statistically significant step up or down in value distribution
• trend_change: there is an overall trend change occurring at this point

The following example detects a step change in a metric:

ROW key=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25]
| MV_EXPAND key
| EVAL value = CASE(key<13, 0, 50)
| CHANGE_POINT value ON key
| WHERE type IS NOT NULL
| EVAL pvalue = ROUND(pvalue, 6)
		

The following example detects two step changes in a metric:

ROW key=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39]
| MV_EXPAND key
| EVAL value = CASE(key<13, 0, key<26, 25, 50)
| CHANGE_POINT value ON key
| WHERE type IS NOT NULL
| EVAL pvalue = ROUND(pvalue, 6)
		

The following example detects a step change independently for each group:

ROW k=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25], location=[12,13,14]
| MV_EXPAND k
| MV_EXPAND location
| EVAL value=CASE(k<location, 0, 50)
| CHANGE_POINT value ON k BY location
| WHERE type IS NOT NULL
| pvalue = ROUND(pvalue, 6)
		

The following example detects two step changes independently for each group:

ROW k=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39], location=[12,13,14]
| MV_EXPAND k
| MV_EXPAND location
| EVAL value=CASE(k<location, 0, k<location+13, 25, 50)
| CHANGE_POINT value ON k BY location
| WHERE type IS NOT NULL
| pvalue = ROUND(pvalue, 6)