ES|QL change_point docs and tech preview

docs/reference/query-languages/esql/esql-commands.md

@@ -31,6 +31,7 @@ An {{esql}} source command produces a table, typically with data from {{es}}. An
 
 {{esql}} supports these processing commands:
 
+* [preview] [`CHANGE_POINT`](#esql-change-point)
 * [`DISSECT`](#esql-dissect)
 * [`DROP`](#esql-drop)
 * [`ENRICH`](#esql-enrich)
@@ -191,6 +192,69 @@ SHOW INFO
 | 8.13.0 | 2024-02-23T10:04:18.123117961Z | 04ba8c8db2507501c88f215e475de7b0798cb3b3 |
 
 
+## `CHANGE_POINT` [esql-change-point]
+
+::::{warning}
+This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
+::::
+
+`CHANGE_POINT` detects spikes, dips, and change points in a metric.
+
+**Syntax**
+
+```esql
+CHANGE_POINT value [ON key] [AS type_name, pvalue_name]
+```
+
+**Parameters**
+
+`value`
+:   The column with the metric in which you want to detect a change point.
+
+`key`
+:   The column with the key to order the values by. If not specified, `@timestamp` is used.
+
+`type_name`
+:   The name of the output column with the change point type. If not specified, `type` is used.
+
+`pvalue_name`
+:   The name of the output column with the p-value that indicates how extreme the change point is. If not specified, `pvalue` is used.
+
+**Description**
+
+`CHANGE_POINT` detects spikes, dips, and change points in a metric. The command adds columns to
+the table with the change point type and p-value, that indicates how extreme the change point is
+(lower values indicate greater changes).
+
+The possible change point types are:
+* `dip`: a significant dip occurs at this change point
+* `distribution_change`: the overall distribution of the values has changed significantly
+* `spike`: a significant spike occurs at this point
+* `step_change`: the change indicates a statistically significant step up or down in value distribution
+* `trend_change`: there is an overall trend change occurring at this point
+
+::::{note}
+There must be at least 22 values for change point detection. Fewer than 1,000 is preferred.
+::::
+
+**Examples**
+
+The following example shows the detection of a step change:
+
+```
+ROW key = [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25]
+| MV_EXPAND key
+| EVAL value = CASE(key<13, 0, 42)
+| CHANGE_POINT value ON key
+| WHERE type IS NOT NULL
+;
+```
+
+| key:integer | value:integer | type:keyword | pvalue:double |
+|-------------|---------------|--------------|---------------|
+| 13          | 42            | step_change  | 0.0           |
+
+
 ## `DISSECT` [esql-dissect]
 
 `DISSECT` enables you to [extract structured data out of a string](/reference/query-languages/esql/esql-process-data-with-dissect-grok.md).

x-pack/plugin/esql/qa/testFixtures/src/main/resources/change_point.csv-spec

@@ -1198,3 +1198,18 @@ true        | 1             | null         | null
 true        | 1             | null         | null         
 true        | 1             | null         | null         
 ;
+
+
+example for docs
+required_capability: change_point
+
+ROW key=[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25]
+| MV_EXPAND key
+| EVAL value = CASE(key<13, 0, 42)
+| CHANGE_POINT value ON key
+| WHERE type IS NOT NULL
+;
+
+key:integer | value:integer | type:keyword | pvalue:double
+13          | 42            | step_change  | 0.0          
+;

x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlCapabilities.java

@@ -843,7 +843,7 @@ public enum Cap {
         /**
          * Support change point detection "CHANGE_POINT".
          */
-        CHANGE_POINT(Build.current().isSnapshot()),
+        CHANGE_POINT,
 
         /**
          * Fix for https://github.com/elastic/elasticsearch/issues/120817