[Lens] Provide single-value functions to show the "First" or "Last" value of some field

[wylieconlon]

This would be implemented using Top Hits, but is a somewhat common user request. This would let Lens show non-numeric values, which is particularly useful for the table visualization.

First and Last require a sort order.

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[wylieconlon]

As discussed with @flash1293, one of the benefits of this approach is that we would be able to show the value of any field, not just aggregatable fields. For example, we could let users visualize full text, lat/long, JSON or other fields that can't normally be visualized.

The supported chart types for this could be:

• Data table
• "Big metric" visualization could show text instead of a number
• It can't be shown on the Y axis, but maybe we can introduce a new dimension for the XY charts called "Tooltip only".

Before this can be done at all, we'd need to remove some of the limitations on the field list shown in Lens: these non-aggregatable fields are currently hidden.

cc @AlonaNadler this idea of increasing the number of fields that can be shown in Lens is one that has come up in the context of cross-linking to Maps

[wylieconlon]

We aren't ready to start on this yet, waiting for discussion with @AlonaNadler and @cchaos about the use cases we're trying to meet and general scope.

[wylieconlon]

We probably want to do something differently from how the Top Hits aggregation is shown in Visualize and TSVB, so here are the open questions:

• Does the first/last function always have a size of 1?
  • If yes, we are removing features compared to Visualize, but these extra features might not be important
  • If no, we need to add extra options to the metric to match Visualize (Size and Aggregate function). The aggregate functions are different for numbers and strings.
• Does the user choose the sort order for first/last?
  • The default sort order is the primary time field of the index pattern
  • The main question is whether we want to allow sorting by other fields.
• Should the top hits aggregation show the entire list of fields for the index pattern, including non-aggregatable fields?
  • If yes, we will likely implement a separate field list for this function without the feature of "available fields" that we do everywhere else
  • If no, we will miss out on full-text fields that users might want

[flash1293]

Discussion outcomes:

• There is just a single operation called "Last" (or "Last value"), switching the sort order around is a toggle setting within the operation
• We will start with a fixed size of 1 (no aggregate function needed)
• The user can pick a field to get the last value of using the current regular field list (split by available and empty fields, non-aggregate-able fields are not shown)
• Sort field defaults to the default time field of the current index, if there is none to the first time field in the index
• The user is allowed to switch between all time fields in the current index for sorting
• If there is no time field, the operation can't be picked and is greyed out in the operation list with an explanatory tooltip
• "Last value" is not picked by default over other operations on dropping a field in the workspace or into a dimension group, (maybe except for date fields in the single metric visualization)
• To fetch data, this operation is using the top hits aggregation of esaggs