You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Change point aggregation [search-aggregations-change-point-aggregation]
8
11
9
-
10
-
::::{warning}
11
-
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
12
-
::::
13
-
14
-
15
12
A sibling pipeline that detects, spikes, dips, and change points in a metric. Given a distribution of values provided by the sibling multi-bucket aggregation, this aggregation indicates the bucket of any spike or dip and/or the bucket at which the largest change in the distribution of values, if they are statistically significant.
16
13
17
14
::::{tip}
18
15
It is recommended to use the change point aggregation to detect changes in time-based data, however, you can use any metric to create buckets.
19
16
::::
20
17
21
-
22
18
## Parameters [change-point-agg-syntax]
23
19
24
20
`buckets_path`
25
21
: (Required, string) Path to the buckets that contain one set of values in which to detect a change point. There must be at least 22 bucketed values. Fewer than 1,000 is preferred. For syntax, see [`buckets_path` Syntax](/reference/aggregations/pipeline.md#buckets-path-syntax).
26
22
27
-
28
23
## Syntax [_syntax_11]
29
24
30
25
A `change_point` aggregation looks like this in isolation:
@@ -39,8 +34,6 @@ A `change_point` aggregation looks like this in isolation:
39
34
40
35
1. The buckets containing the values to test against.
41
36
42
-
43
-
44
37
## Response body [change-point-agg-response]
45
38
46
39
`bucket`
@@ -54,7 +47,6 @@ A `change_point` aggregation looks like this in isolation:
54
47
`doc_count`
55
48
: (number) The document count of the bucket.
56
49
57
-
58
50
`type`
59
51
: (object) The found change point type and its related values. Possible types:
60
52
@@ -67,7 +59,6 @@ A `change_point` aggregation looks like this in isolation:
67
59
* `trend_change`: there is an overall trend change occurring at this point
68
60
69
61
70
-
71
62
## Example [_example_7]
72
63
73
64
The following example uses the Kibana sample data logs data set.
@@ -103,7 +94,6 @@ GET kibana_sample_data_logs/_search
103
94
3. The change point detection aggregation configuration object.
104
95
4. The path of the aggregation values to detect change points. In this case, the input of the change point aggregation is the value of `avg` which is a sibling aggregation of `date`.
105
96
106
-
107
97
The request returns a response that is similar to the following:
108
98
109
99
```js
@@ -130,6 +120,3 @@ The request returns a response that is similar to the following:
130
120
4. Type of change found.
131
121
5. The `p_value` indicates how extreme the change is; lower values indicate greater change.
132
122
6. The specific bucket where the change occurs (indexing starts at `0`).
0 commit comments