Index pattern creation UX: Remove UI for creating index patterns based on event times

[cjcenizal]

Per discussion, we should remove this functionality from the UI, though still support the ability on the back-end.

[Bargs]

There are still users who use this for performance reasons so we need to make sure we've resolved those issues before taking it away.

[skearns64]

@Bargs - Thanks for linking that issue! That is a valid issue, though ES is now addressing both parts of the underlying issue raised there:

elastic/elasticsearch#23946 - This handles incremental reduction of results from shards, reducing the amount of memory on the coordinating node, which should improve things significantly, and this effectively removes the need for using _field_stats to look up the date ranges for each field in each index.

In elastic/elasticsearch#23007 we add a new _field_caps API for retrieving the field "capabilities", which is a more targeted API that fulfills the other role that _field_stats was filling. This is a much lighter-weight API, which should retrieve these.

In short, I think that we're in good shape to move forward with this issue, given that we have an approach that should improve performance generally and avoid the issues highlighted in the issue above.

[Bargs]

@skearns64 we still need to remove our usage of _field_stats to take advantage of the improvements in elastic/elasticsearch#23946, no? elastic/elasticsearch#23007 won't help us in the issue I linked, it's only useful at index pattern creation time when we're grabbing the aggregatable and searchable status of each field. We might be able to simply remove the field stats call that determines which indices to query based on the time range selected, but we should experiment with that before removing the ability to create index patterns based on event times.

[skearns64]

Indeed, switching _field_stats to _field_caps is tracked in #11014 and is high priority, last I heard, so while we might want to block this issue on that being done, I don't think it will actually delay progress here.

The issue you linked originally is slow because the _field_stats call hits every shard, before the queries are even run. If we stop using _field_stats before we make the request, ( described in #6644 ), that should remove one whole roundtrip, and elastic/elasticsearch#23946 should reduce the impact of querying many shards, while caching on the various shards themselves should reduce the overhead as well.

Definitely still worth testing, but I think we're good to move forward on this soon.

[Bargs]

We might be on the same page, but I just wanna be sure:

Indeed, switching _field_stats to _field_caps is tracked in #11014 and is high priority, last I heard, so while we might want to block this issue on that being done, I don't think it will actually delay progress here.

Right, I'm just pointing out that #11014 won't fix the issue I linked to. We use _field_stats in two totally separate ways in Kibana, and #11014 only addresses one of them, unless @spalger is planning on addressing both, which his description doesn't imply to me. I know it links to the issue I mentioned, but based on the rest of the description that looks to me like a mistake.

The issue you linked originally is slow because the _field_stats call hits every shard, before the queries are even run. If we stop using _field_stats before we make the request, ( described in #6644 ), that should remove one whole roundtrip, and elastic/elasticsearch#23946 should reduce the impact of querying many shards, while caching on the various shards themselves should reduce the overhead as well.

Yup exactly, I just don't want to leave users in a bind where they no longer have this workaround available but we have not yet removed our _field_stats use that's causing issues.

[spalger]

Not quite following the discussion, but #11011 (support cross-cluster search) is the meta issue that's driving #11014 (switching to _field_caps). In #11011 we will be deprecating the "Do not expand index pattern when searching" option and defaulting to just querying all shards. None of the index pattern "modes" are slated for removal as a part of this though, just deprecation.

[epixa]

I created #11150 to track the field_stats search behavior specifically. We shouldn't outright remove field_stats right now, but we can change the default for new indices to search directly against Elasticsearch with the index pattern.

[cjcenizal]

Closing in favor of #10444