77
88experimental::[]
99
10- A sibling pipeline that detects, spikes, dips, and change points in a metric. Given a distribution of values
11- provided by the sibling multi-bucket aggregation, this aggregation indicates the bucket of any spike or dip
12- and/or the bucket at which the largest change in the distribution of values, if they are statistically significant.
10+ A sibling pipeline that detects, spikes, dips, and change points in a metric.
11+ Given a distribution of values provided by the sibling multi-bucket aggregation,
12+ this aggregation indicates the bucket of any spike or dip and/or the bucket at
13+ which the largest change in the distribution of values, if they are
14+ statistically significant.
15+
16+ TIP: It is recommended to use the change point aggregation to detect changes in
17+ time-based data, however, you can use any metric to create buckets.
1318
1419
1520
@@ -18,8 +23,8 @@ and/or the bucket at which the largest change in the distribution of values, if
1823
1924`buckets_path`::
2025(Required, string)
21- Path to the buckets that contain one set of values in which to detect a change point. There must be at least 22 bucketed
22- values. Fewer than 1,000 is preferred.
26+ Path to the buckets that contain one set of values in which to detect a change
27+ point. There must be at least 22 bucketed values. Fewer than 1,000 is preferred.
2328For syntax, see <<buckets-path-syntax>>.
2429
2530==== Syntax
@@ -42,8 +47,9 @@ A `change_point` aggregation looks like this in isolation:
4247
4348`bucket`::
4449(Optional, object)
45- Values of the bucket that indicates the discovered change point. Not returned if no change point was found.
46- All the aggregations in the bucket are returned as well.
50+ Values of the bucket that indicates the discovered change point. Not returned if
51+ no change point was found. All the aggregations in the bucket are returned as
52+ well.
4753+
4854.Properties of bucket
4955[%collapsible%open]
@@ -63,11 +69,14 @@ The found change point type and its related values. Possible types:
6369+
6470--
6571* `dip`: a significant dip occurs at this change point
66- * `distribution_change`: the overall distribution of the values has changed significantly
67- * `non_stationary`: there is no change point, but the values are not from a stationary distribution
72+ * `distribution_change`: the overall distribution of the values has changed
73+ significantly
74+ * `non_stationary`: there is no change point, but the values are not from a
75+ stationary distribution
6876* `spike`: a significant spike occurs at this point
6977* `stationary`: no change point found
70- * `step_change`: the change indicates a statistically significant step up or down in value distribution
78+ * `step_change`: the change indicates a statistically significant step up or
79+ down in value distribution
7180* `trend_change`: there is an overall trend change occurring at this point
7281--
7382
@@ -138,5 +147,6 @@ The request returns a response that is similar to the following:
138147<2> The number of documents in that bucket.
139148<3> Aggregated values in the bucket.
140149<4> Type of change found.
141- <5> The `p_value` indicates how extreme the change is; lower values indicate greater change.
150+ <5> The `p_value` indicates how extreme the change is; lower values indicate
151+ greater change.
142152<6> The specific bucket where the change occurs (indexing starts at `0`).
0 commit comments