[ES|QL] Adds a change point recommendation (#216748)

## Summary

**Merge after Change point moves to Tech preview**

Adds a change point detection recommendation

<img width="833" alt="image"
src="https://github.com/user-attachments/assets/9834b034-99f8-447a-b822-bb85e42f220c"
/>

<img width="741" alt="image"
src="https://github.com/user-attachments/assets/dc97af55-1263-4fe9-9699-426184ffe71a"
/>
This commit is contained in:
Stratoula Kalafateli 2025-04-16 07:49:38 +02:00 committed by GitHub
parent 34049fe9b8
commit 6f5a3c900b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -115,6 +115,21 @@ export const getRecommendedQueries = ({
),
queryString: `${fromCommand}\n | STATS count = COUNT(*), min_timestamp = MIN(${timeField}) /* MIN(dateField) finds the earliest timestamp in the dataset. */ \n | EVAL event_rate = count / DATE_DIFF("seconds", min_timestamp, NOW()) /* Calculates the event rate by dividing the total count of events by the time difference (in seconds) between the earliest event and the current time. */\n | KEEP event_rate`,
},
{
label: i18n.translate(
'kbn-esql-validation-autocomplete.recommendedQueries.categorize.label',
{
defaultMessage: 'Detect change points',
}
),
description: i18n.translate(
'kbn-esql-validation-autocomplete.recommendedQueries.categorize.description',
{
defaultMessage: 'Change point on count aggregation',
}
),
queryString: `${fromCommand}\n | WHERE ${timeField} <=?_tend and ${timeField} >?_tstart\n | STATS count = COUNT(*) BY buckets = BUCKET(${timeField}, 50, ?_tstart, ?_tend) \n | CHANGE_POINT count ON buckets `,
},
{
label: i18n.translate(
'kbn-esql-validation-autocomplete.recommendedQueries.lastHour.label',