ES|QL change point docs

Author: jan-elastic

docs/reference/query-languages/esql/esql-commands.md

@@ -31,6 +31,7 @@ An {{esql}} source command produces a table, typically with data from {{es}}. An
 
 {{esql}} supports these processing commands:
 
+* [`CHANGE_POINT`](#esql-change-point)
 * [`DISSECT`](#esql-dissect)
 * [`DROP`](#esql-drop)
 * [`ENRICH`](#esql-enrich)
@@ -191,6 +192,63 @@ SHOW INFO
 | 8.13.0 | 2024-02-23T10:04:18.123117961Z | 04ba8c8db2507501c88f215e475de7b0798cb3b3 |
 
 
+## `CHANGE_POINT` [esql-change-point]
+
+`CHANGE_POINT` detects spikes, dips, and change points in a metric.
+
+**Syntax**
+
+```esql
+CHANGE_POINT value [ON key] [AS type_name, pvalue_name]
+```
+
+**Parameters**
+
+`value`
+:   The column with the metric in which you want to detect a change point.
+
+`key`
+:   The column with the key to order the values by. If not specified, `@timestamp` is used.
+
+`type_name`
+:   The name of the output column with the change point type. If not specified, `type` is used.
+
+`pvalue_name`
+:   The name of the output column with the p-value that indicates how extreme the change point is. If not specified, `pvalue` is used.
+
+**Description**
+
+`CHANGE_POINT` detects spikes, dips, and change points in a metric. The command adds columns to
+the table with the change point type and p-value, that indicates how extreme the change point is
+(lower values indicate greater changes).
+
+The possible change point types are:
+* `dip`: a significant dip occurs at this change point
+* `distribution_change`: the overall distribution of the values has changed significantly
+* `spike`: a significant spike occurs at this point
+* `step_change`: the change indicates a statistically significant step up or down in value distribution
+* `trend_change`: there is an overall trend change occurring at this point
+
+::::{note}
+There must be at least 22 values for change point detection. Fewer than 1,000 is preferred.
+::::
+
+**Examples**
+
+The following example shows whether there is a day with a significant change in the number of log messages:
+
+```
+FROM kibana_sample_data_logs
+| STATS message_count=COUNT() BY day=BUCKET(@timestamp, 1 DAY)
+| CHANGE_POINT message_count ON day
+| WHERE type IS NOT NULL
+```
+
+| message_count:long | day:datetime             | type:keyword | pvalue:double          |
+|--------------------|--------------------------|--------------|------------------------|
+| 329                | 2025-05-10T00:00:00.000Z | spike        | 7.284562237089151e-198 |
+
+
 ## `DISSECT` [esql-dissect]
 
 `DISSECT` enables you to [extract structured data out of a string](/reference/query-languages/esql/esql-process-data-with-dissect-grok.md).