[ML] Support runtime fields

[peteharverson]

Elasticsearch is adding a new feature called "runtime fields" in 7.10. This meta issue tracks the changes that are required to the ML and Transforms Kibana plugins to support the use of runtime fields.

ML

• Source data grid table cells are empty for runtime fields defined in the mappings that are not present in _source (7.10 - [ML] Add runtime fields support #78700)
• Anomaly detection datafeed preview uses _source (advanced wizard, jobs list) (7.10 - [ML] Add runtime fields support #78700)
• Categorization job wizard prevents use of a runtime field defined in the mappings that is not present in _source, failing at the No examples for this field could be found step (7.10 - [ML] Add runtime fields support #78700)
• Testing a custom_url which uses a runtime field for a job which has not yet created anomalies looks for field _source (7.10 - [ML] Add runtime fields support #78700)
• Not currently necessary, but models/data_visualizer/data_visualizer.ts gets field examples for non aggregatable fields from _source. Probably worth changing to use fields API in case text and geo_point are added to runtime types. (7.12 - [ML] Add embedded map to geo_point fields for Data Visualizer #88880)
• Data Visualizer not showing search-time runtime fields (7.13 - [ML] Add search time runtime support for index based Data Visualizer #95252)
• Use full data button not working in the Anomaly detection job wizards when using a saved search with runtime fields (7.13 - [ML] Fix Anomaly Detection wizard full time range chart blank with saved search containing runtime fields #95700)
• Display anomaly charts for detectors with search-time runtime fields and no model plot (7.13 - [ML] Add runtime support for anomaly charts & add composite validations #96348)
• Job created from a saved search which uses a runtime field with a wildcard (e.g. airline_rt: a*) removes the runtime field from the runtime_mappings when it isn't used as an influencer or partitioning field so job fails (7.13 - [ML] Improve check for runtime fields in datafeed query #98289)

Transforms

• Source data grid table cells are empty for runtime fields defined in the mappings that are not present in _source (example below responsetimeplus is a runtime field) (7.10 - [ML] Add runtime fields support #78700)

• Add better UI support for runtime fields: (7.12 - [ML] Add better UI support for runtime fields Transforms  #90363)
  - Cloning transform job that includes runtime_mappings
  - Support creating and cloning transform job where index pattern has runtime fields
  - Add advanced runtime mapping editor
• Data grid histograms are not displayed for search-time runtime fields (7.12 - [ML] Transforms: Fixes chart histograms for runtime fields. #93028)

We should switch from obtaining field values from _source and switch to using the new Elasticsearch fields API.

[elasticmachine]

Pinging @elastic/ml-ui (:ml)

[peteharverson]

When creating a date_histogram groupby transform preview by using a big dataset (like Nginx), a 500 internal server error was thrown.

Re-tested this with 7.12.0 against a large Nginx dataset which used a date_histogram group-by on a runtime field defined in the ES mappings and did not see the 500 internal server error on preview, but the request can take several minutes to return, during which the preview table is empty.

For 7.13.0 elastic/elasticsearch#68396 has introduced header warnings for the _preview endpoint. This should be used to provide hints to users in the Transforms creation wizard, such as warning if all fields in the group_by are runtime fields - a separate issue #93919 has been raised to cover this work.