Skip to content

Commit a99a273

Browse files
committed
different example + add it the csv tests
1 parent bbaf607 commit a99a273

File tree

2 files changed

+24
-7
lines changed

2 files changed

+24
-7
lines changed

docs/reference/query-languages/esql/esql-commands.md

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -239,18 +239,20 @@ There must be at least 22 values for change point detection. Fewer than 1,000 is
239239

240240
**Examples**
241241

242-
The following example shows whether there is a day with a significant change in the number of log messages:
242+
The following example shows the detection of a step change:
243243

244244
```
245-
FROM kibana_sample_data_logs
246-
| STATS message_count=COUNT() BY day=BUCKET(@timestamp, 1 DAY)
247-
| CHANGE_POINT message_count ON day
245+
ROW key = [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25]
246+
| MV_EXPAND key
247+
| EVAL value = CASE(key<13, 0, 42)
248+
| CHANGE_POINT value ON key
248249
| WHERE type IS NOT NULL
250+
;
249251
```
250252

251-
| message_count:long | day:datetime | type:keyword | pvalue:double |
252-
|--------------------|--------------------------|--------------|------------------------|
253-
| 329 | 2025-05-10T00:00:00.000Z | spike | 7.284562237089151e-198 |
253+
| key:integer | value:integer | type:keyword | pvalue:double |
254+
|-------------|---------------|--------------|---------------|
255+
| 13 | 42 | step_change | 0.0 |
254256

255257

256258
## `DISSECT` [esql-dissect]

x-pack/plugin/esql/qa/testFixtures/src/main/resources/change_point.csv-spec

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1198,3 +1198,18 @@ true | 1 | null | null
11981198
true | 1 | null | null
11991199
true | 1 | null | null
12001200
;
1201+
1202+
1203+
example for docs
1204+
required_capability: change_point
1205+
1206+
ROW key=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25]
1207+
| MV_EXPAND key
1208+
| EVAL value = CASE(key<13, 0, 42)
1209+
| CHANGE_POINT value ON key
1210+
| WHERE type IS NOT NULL
1211+
;
1212+
1213+
key:integer | value:integer | type:keyword | pvalue:double
1214+
13 | 42 | step_change | 0.0
1215+
;

0 commit comments

Comments
 (0)