feat(slo): Add timestampField additional settings

[kdelemme]

Summary

Resolves #153397

This PR adds the timestampField's additional settings in the create/edit SLO form.

While working on this, I noticed that we were using the settings.timestampField in all transforms, with a @timestamp default value if not provided.
This could lead to potential issue as APM data are always ingested using @timestamp field, therefore, the timestampField needed to become a custom KQL indicator specificities, and should not be overridable for APM indicator types.

Therefore, I've moved the settings.timestampField to the custom KQL indicator.params as an optional field. When not provided, or empty (""), the transform uses @timestamp.
APM transforms have been changed to always use @timestamp.

Finally, I've updated the OpenAPI documentation as well as the dev docs.

🧪 Manual testing

From the API

curl --request POST \
  --url http://localhost:5601/kibana/api/observability/slos \
  --header 'Authorization: Basic ZWxhc3RpYzpjaGFuZ2VtZQ==' \
  --header 'Content-Type: application/json' \
  --header 'kbn-xsrf: oui' \
  --data '{
	"name": "latency logs service",
	"description": "latency from logs",
	"indicator": {
		"type": "sli.kql.custom",
		"params": {
			"index": "service-logs-latency*",
			"good": "latency < 150",
			"total": "",
			"filter": "",
			"timestampField": "my_timestamp"
		}
	},
	"timeWindow": {
		"duration": "30d",
		"isRolling": true
	},
	"budgetingMethod": "occurrences",
	"objective": {
		"target": 0.98
	}
}'

• ✅ Check the transform is created with the correct my_timestamp field

From the UI

Create a custom KQL SLO and override (and not) the timestampField under the additional settings.

• ✅ Check the transform is created with the provided timestampField
• ✅ Check the transform is created with the default @timestamp when not overridden

[elasticmachine]

Pinging @elastic/actionable-observability (Team: Actionable Observability)

[CoenWarmer]

Tested, works as expected. LGTM!

[afharo]

SO mapping changes LGTM

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 5b7ad15
• Storybooks Preview

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
observability	512	513	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
observability	1.1MB	1.1MB	+1.2KB

Saved Objects .kibana field count

Every field in each saved object type adds overhead to Elasticsearch. Kibana needs to keep the total field count below Elasticsearch's default limit of 1000 fields. Only specify field mappings for the fields you wish to search on or query. See https://www.elastic.co/guide/en/kibana/master/saved-objects-service.html#_mappings

id	before	after	diff
slo	26	25	-1

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	433	436	+3

Total ESLint disabled count

id	before	after	diff
securitySolution	513	516	+3

History

• 💚 Build #114617 succeeded 01650b8
• 💔 Build #114494 failed a5f872c
• 💔 Build #114491 failed 20cb2f5

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @kdelemme