…during alert indexing and a workaround for an EQL bug (elastic#110927)

## Summary

Adds a workaround for EQL bug: elastic/elasticsearch#77152
Adds the safety feature mentioned here: elastic#110802

Adds the ability to ignore particular [fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) when the field is merged with [_source](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#source-filtering). Also fixes an EQL bug where EQL is introducing the meta field of `_ignored` within the fields and causing documents to not be indexable when we merge with the fields from EQL. 

Alerting document creation uses the fields API to get [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html),  [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type), etc... that are only available within the [fields API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) and then merges the field values not found within the `_source` document with the `_source` document and then finally indexes this merged document as an alert document.

This fix/ability is a "safety feature" in that if a problematic [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html), [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type) is discovered or another bug along the stack we can set a `kibana.yml` key/value pair to ignore the problematic field.

This _WILL NOT_ remove problematic fields from the `_source` document. This will only ignore problematic constant keyword, runtime fields, aliases, or anything else found in the fields API that is causing merge issues.

This PR:
  * Adds a `alertIgnoreFields` `kibana.yml` array key with a default of an empty array if not specified. 
  * Plumbs the `alertIgnoreFields` through the stack and into the fields/_source merge strategies of `missingFields` and `allFields`
  * Adds a temporary `isEqlBug77152` where it hard codes an ignore of `_ignored` until the EQL problem is fixed and then we will remove the workaround
  * Adds unit tests
  * Adds e2e tests which covers the described use cases above.

The `alertIgnoreFields` key/value within `kibana.yml` if set should be an array of strings of each field you want to ignore. This can also contain regular expressions as long as they are of the form, `"/regex/"` in the array.

Example if you want to ignore fields that are problematic called "host.name" and then one in which you want to ignore all fields that start with "user." using a regular expression:

```yml
xpack.securitySolution.alertIgnoreFields: ['host.name', '/user\..*/']
``` 

Although there are e2e tests which exercise the use cases...

If you want to manual test the EQL bug fix you would add these documents in dev tools:

```json
# Delete and add a mapping with a small ignore_above.
DELETE eql-issue-ignore-fields-delme
PUT eql-issue-ignore-fields-delme
{
  "mappings" : {
    "dynamic": "strict",
    "properties" : {
      "@timestamp": {
        "type": "date"
      },
      "some_keyword" : {
        "ignore_above": 5, 
        "type" : "keyword"
      },
      "other_keyword" : {
        "ignore_above": 10, 
        "type" : "keyword"
      }
    }
  }
}

# Add a single document with one field that will be truncated and a second that will not.
PUT eql-issue-ignore-fields-delme/_doc/1
{
  "@timestamp": "2021-09-02T04:13:05.626Z",
  "some_keyword": "longer than normal",
  "other_keyword": "normal"
}
```

Then create an alert which queries everything from it:
<img width="1155" alt="Screen Shot 2021-09-01 at 10 15 06 PM" src="https://user-images.githubusercontent.com/1151048/131781042-faa424cf-65a5-4ebb-b801-3f188940c81d.png">

and ensure signals are created:
<img width="2214" alt="Screen Shot 2021-09-01 at 10 30 18 PM" src="https://user-images.githubusercontent.com/1151048/131782069-b9ab959c-f22d-44d5-baf0-561fe349c037.png">

To test the manual exclusions of any other problematic fields, create any index which has runtime fields or `constant keywords` but does not have anything within the `_source` document using dev tools. For example you can use `constant keyword` like so

```json
PUT constant-keywords-deleme
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "testing_ignored": {
        "properties": {
          "constant": {
            "type": "constant_keyword",
            "value": "constant_value"
          }
        }
      },
      "testing_regex": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "normal_constant": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "small_field": {
        "type": "keyword",
        "ignore_above": 10
      }
    }
  }
}

PUT constant-keywords-deleme/_doc/1
{
  "@timestamp": "2021-09-02T04:20:01.760Z"
}
```

Set in your `kibana.yml` the key/value of:

```yml
xpack.securitySolution.alertIgnoreFields: ['testing_ignored.constant', '/.*_regex/']
```

Setup a rule to run:
<img width="1083" alt="Screen Shot 2021-09-01 at 10 23 23 PM" src="https://user-images.githubusercontent.com/1151048/131781696-fea0d421-836f-465c-9be6-5289fbb622a4.png">

Once it runs you should notice that the constant values for testing are not on the signals table since it only typically exists in the fields API:
<img width="1166" alt="Screen Shot 2021-09-01 at 10 26 16 PM" src="https://user-images.githubusercontent.com/1151048/131781782-1684fb1d-bed9-4cf0-be9a-0abe1f0f34d1.png">

But the normal one still exists:
<img width="1136" alt="Screen Shot 2021-09-01 at 10 26 31 PM" src="https://user-images.githubusercontent.com/1151048/131781827-5450c693-de9e-4285-b082-9f7a2cbd5d07.png">

If you change the `xpack.securitySolution.alertIgnoreFields` by removing it and re-generate the signals you will see these values added back.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/master/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)

…during alert indexing and a workaround for an EQL bug (elastic#110927)

Adds a workaround for EQL bug: elastic/elasticsearch#77152
Adds the safety feature mentioned here: elastic#110802

Adds the ability to ignore particular [fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) when the field is merged with [_source](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#source-filtering). Also fixes an EQL bug where EQL is introducing the meta field of `_ignored` within the fields and causing documents to not be indexable when we merge with the fields from EQL.

Alerting document creation uses the fields API to get [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html),  [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type), etc... that are only available within the [fields API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) and then merges the field values not found within the `_source` document with the `_source` document and then finally indexes this merged document as an alert document.

This fix/ability is a "safety feature" in that if a problematic [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html), [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type) is discovered or another bug along the stack we can set a `kibana.yml` key/value pair to ignore the problematic field.

This _WILL NOT_ remove problematic fields from the `_source` document. This will only ignore problematic constant keyword, runtime fields, aliases, or anything else found in the fields API that is causing merge issues.

This PR:
  * Adds a `alertIgnoreFields` `kibana.yml` array key with a default of an empty array if not specified.
  * Plumbs the `alertIgnoreFields` through the stack and into the fields/_source merge strategies of `missingFields` and `allFields`
  * Adds a temporary `isEqlBug77152` where it hard codes an ignore of `_ignored` until the EQL problem is fixed and then we will remove the workaround
  * Adds unit tests
  * Adds e2e tests which covers the described use cases above.

The `alertIgnoreFields` key/value within `kibana.yml` if set should be an array of strings of each field you want to ignore. This can also contain regular expressions as long as they are of the form, `"/regex/"` in the array.

Example if you want to ignore fields that are problematic called "host.name" and then one in which you want to ignore all fields that start with "user." using a regular expression:

```yml
xpack.securitySolution.alertIgnoreFields: ['host.name', '/user\..*/']
```

Although there are e2e tests which exercise the use cases...

If you want to manual test the EQL bug fix you would add these documents in dev tools:

```json
DELETE eql-issue-ignore-fields-delme
PUT eql-issue-ignore-fields-delme
{
  "mappings" : {
    "dynamic": "strict",
    "properties" : {
      "@timestamp": {
        "type": "date"
      },
      "some_keyword" : {
        "ignore_above": 5,
        "type" : "keyword"
      },
      "other_keyword" : {
        "ignore_above": 10,
        "type" : "keyword"
      }
    }
  }
}

PUT eql-issue-ignore-fields-delme/_doc/1
{
  "@timestamp": "2021-09-02T04:13:05.626Z",
  "some_keyword": "longer than normal",
  "other_keyword": "normal"
}
```

Then create an alert which queries everything from it:
<img width="1155" alt="Screen Shot 2021-09-01 at 10 15 06 PM" src="https://user-images.githubusercontent.com/1151048/131781042-faa424cf-65a5-4ebb-b801-3f188940c81d.png">

and ensure signals are created:
<img width="2214" alt="Screen Shot 2021-09-01 at 10 30 18 PM" src="https://user-images.githubusercontent.com/1151048/131782069-b9ab959c-f22d-44d5-baf0-561fe349c037.png">

To test the manual exclusions of any other problematic fields, create any index which has runtime fields or `constant keywords` but does not have anything within the `_source` document using dev tools. For example you can use `constant keyword` like so

```json
PUT constant-keywords-deleme
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "testing_ignored": {
        "properties": {
          "constant": {
            "type": "constant_keyword",
            "value": "constant_value"
          }
        }
      },
      "testing_regex": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "normal_constant": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "small_field": {
        "type": "keyword",
        "ignore_above": 10
      }
    }
  }
}

PUT constant-keywords-deleme/_doc/1
{
  "@timestamp": "2021-09-02T04:20:01.760Z"
}
```

Set in your `kibana.yml` the key/value of:

```yml
xpack.securitySolution.alertIgnoreFields: ['testing_ignored.constant', '/.*_regex/']
```

Setup a rule to run:
<img width="1083" alt="Screen Shot 2021-09-01 at 10 23 23 PM" src="https://user-images.githubusercontent.com/1151048/131781696-fea0d421-836f-465c-9be6-5289fbb622a4.png">

Once it runs you should notice that the constant values for testing are not on the signals table since it only typically exists in the fields API:
<img width="1166" alt="Screen Shot 2021-09-01 at 10 26 16 PM" src="https://user-images.githubusercontent.com/1151048/131781782-1684fb1d-bed9-4cf0-be9a-0abe1f0f34d1.png">

But the normal one still exists:
<img width="1136" alt="Screen Shot 2021-09-01 at 10 26 31 PM" src="https://user-images.githubusercontent.com/1151048/131781827-5450c693-de9e-4285-b082-9f7a2cbd5d07.png">

If you change the `xpack.securitySolution.alertIgnoreFields` by removing it and re-generate the signals you will see these values added back.

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/master/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)

…during alert indexing and a workaround for an EQL bug (elastic#110927)

## Summary

Adds a workaround for EQL bug: elastic/elasticsearch#77152
Adds the safety feature mentioned here: elastic#110802

Adds the ability to ignore particular [fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) when the field is merged with [_source](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#source-filtering). Also fixes an EQL bug where EQL is introducing the meta field of `_ignored` within the fields and causing documents to not be indexable when we merge with the fields from EQL.

Alerting document creation uses the fields API to get [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html),  [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type), etc... that are only available within the [fields API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) and then merges the field values not found within the `_source` document with the `_source` document and then finally indexes this merged document as an alert document.

This fix/ability is a "safety feature" in that if a problematic [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html), [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type) is discovered or another bug along the stack we can set a `kibana.yml` key/value pair to ignore the problematic field.

This _WILL NOT_ remove problematic fields from the `_source` document. This will only ignore problematic constant keyword, runtime fields, aliases, or anything else found in the fields API that is causing merge issues.

This PR:
  * Adds a `alertIgnoreFields` `kibana.yml` array key with a default of an empty array if not specified.
  * Plumbs the `alertIgnoreFields` through the stack and into the fields/_source merge strategies of `missingFields` and `allFields`
  * Adds a temporary `isEqlBug77152` where it hard codes an ignore of `_ignored` until the EQL problem is fixed and then we will remove the workaround
  * Adds unit tests
  * Adds e2e tests which covers the described use cases above.

The `alertIgnoreFields` key/value within `kibana.yml` if set should be an array of strings of each field you want to ignore. This can also contain regular expressions as long as they are of the form, `"/regex/"` in the array.

Example if you want to ignore fields that are problematic called "host.name" and then one in which you want to ignore all fields that start with "user." using a regular expression:

```yml
xpack.securitySolution.alertIgnoreFields: ['host.name', '/user\..*/']
```

Although there are e2e tests which exercise the use cases...

If you want to manual test the EQL bug fix you would add these documents in dev tools:

```json
# Delete and add a mapping with a small ignore_above.
DELETE eql-issue-ignore-fields-delme
PUT eql-issue-ignore-fields-delme
{
  "mappings" : {
    "dynamic": "strict",
    "properties" : {
      "@timestamp": {
        "type": "date"
      },
      "some_keyword" : {
        "ignore_above": 5,
        "type" : "keyword"
      },
      "other_keyword" : {
        "ignore_above": 10,
        "type" : "keyword"
      }
    }
  }
}

# Add a single document with one field that will be truncated and a second that will not.
PUT eql-issue-ignore-fields-delme/_doc/1
{
  "@timestamp": "2021-09-02T04:13:05.626Z",
  "some_keyword": "longer than normal",
  "other_keyword": "normal"
}
```

Then create an alert which queries everything from it:
<img width="1155" alt="Screen Shot 2021-09-01 at 10 15 06 PM" src="https://user-images.githubusercontent.com/1151048/131781042-faa424cf-65a5-4ebb-b801-3f188940c81d.png">

and ensure signals are created:
<img width="2214" alt="Screen Shot 2021-09-01 at 10 30 18 PM" src="https://user-images.githubusercontent.com/1151048/131782069-b9ab959c-f22d-44d5-baf0-561fe349c037.png">

To test the manual exclusions of any other problematic fields, create any index which has runtime fields or `constant keywords` but does not have anything within the `_source` document using dev tools. For example you can use `constant keyword` like so

```json
PUT constant-keywords-deleme
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "testing_ignored": {
        "properties": {
          "constant": {
            "type": "constant_keyword",
            "value": "constant_value"
          }
        }
      },
      "testing_regex": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "normal_constant": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "small_field": {
        "type": "keyword",
        "ignore_above": 10
      }
    }
  }
}

PUT constant-keywords-deleme/_doc/1
{
  "@timestamp": "2021-09-02T04:20:01.760Z"
}
```

Set in your `kibana.yml` the key/value of:

```yml
xpack.securitySolution.alertIgnoreFields: ['testing_ignored.constant', '/.*_regex/']
```

Setup a rule to run:
<img width="1083" alt="Screen Shot 2021-09-01 at 10 23 23 PM" src="https://user-images.githubusercontent.com/1151048/131781696-fea0d421-836f-465c-9be6-5289fbb622a4.png">

Once it runs you should notice that the constant values for testing are not on the signals table since it only typically exists in the fields API:
<img width="1166" alt="Screen Shot 2021-09-01 at 10 26 16 PM" src="https://user-images.githubusercontent.com/1151048/131781782-1684fb1d-bed9-4cf0-be9a-0abe1f0f34d1.png">

But the normal one still exists:
<img width="1136" alt="Screen Shot 2021-09-01 at 10 26 31 PM" src="https://user-images.githubusercontent.com/1151048/131781827-5450c693-de9e-4285-b082-9f7a2cbd5d07.png">

If you change the `xpack.securitySolution.alertIgnoreFields` by removing it and re-generate the signals you will see these values added back.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/master/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)

# Conflicts:
#	src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_factory.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_bulk_body.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/wrap_hits_factory.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/indicator_match/create_indicator_match_alert_type.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/indicator_match/create_indicator_match_alert_type.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/ml/create_ml_alert_type.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/ml/create_ml_alert_type.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/wrap_hits_factory.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/wrap_sequences_factory.ts
#	x-pack/plugins/security_solution/server/plugin.ts
#	x-pack/test/detection_engine_api_integration/security_and_spaces/tests/index.ts

…during alert indexing and a workaround for an EQL bug (#110927) (#111156)

## Summary

Adds a workaround for EQL bug: elastic/elasticsearch#77152
Adds the safety feature mentioned here: #110802

Adds the ability to ignore particular [fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) when the field is merged with [_source](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#source-filtering). Also fixes an EQL bug where EQL is introducing the meta field of `_ignored` within the fields and causing documents to not be indexable when we merge with the fields from EQL. 

Alerting document creation uses the fields API to get [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html),  [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type), etc... that are only available within the [fields API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) and then merges the field values not found within the `_source` document with the `_source` document and then finally indexes this merged document as an alert document.

This fix/ability is a "safety feature" in that if a problematic [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html), [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type) is discovered or another bug along the stack we can set a `kibana.yml` key/value pair to ignore the problematic field.

This _WILL NOT_ remove problematic fields from the `_source` document. This will only ignore problematic constant keyword, runtime fields, aliases, or anything else found in the fields API that is causing merge issues.

This PR:
  * Adds a `alertIgnoreFields` `kibana.yml` array key with a default of an empty array if not specified. 
  * Plumbs the `alertIgnoreFields` through the stack and into the fields/_source merge strategies of `missingFields` and `allFields`
  * Adds a temporary `isEqlBug77152` where it hard codes an ignore of `_ignored` until the EQL problem is fixed and then we will remove the workaround
  * Adds unit tests
  * Adds e2e tests which covers the described use cases above.

The `alertIgnoreFields` key/value within `kibana.yml` if set should be an array of strings of each field you want to ignore. This can also contain regular expressions as long as they are of the form, `"/regex/"` in the array.

Example if you want to ignore fields that are problematic called "host.name" and then one in which you want to ignore all fields that start with "user." using a regular expression:

```yml
xpack.securitySolution.alertIgnoreFields: ['host.name', '/user\..*/']
``` 

Although there are e2e tests which exercise the use cases...

If you want to manual test the EQL bug fix you would add these documents in dev tools:

```json
# Delete and add a mapping with a small ignore_above.
DELETE eql-issue-ignore-fields-delme
PUT eql-issue-ignore-fields-delme
{
  "mappings" : {
    "dynamic": "strict",
    "properties" : {
      "@timestamp": {
        "type": "date"
      },
      "some_keyword" : {
        "ignore_above": 5, 
        "type" : "keyword"
      },
      "other_keyword" : {
        "ignore_above": 10, 
        "type" : "keyword"
      }
    }
  }
}

# Add a single document with one field that will be truncated and a second that will not.
PUT eql-issue-ignore-fields-delme/_doc/1
{
  "@timestamp": "2021-09-02T04:13:05.626Z",
  "some_keyword": "longer than normal",
  "other_keyword": "normal"
}
```

Then create an alert which queries everything from it:
<img width="1155" alt="Screen Shot 2021-09-01 at 10 15 06 PM" src="https://user-images.githubusercontent.com/1151048/131781042-faa424cf-65a5-4ebb-b801-3f188940c81d.png">

and ensure signals are created:
<img width="2214" alt="Screen Shot 2021-09-01 at 10 30 18 PM" src="https://user-images.githubusercontent.com/1151048/131782069-b9ab959c-f22d-44d5-baf0-561fe349c037.png">

To test the manual exclusions of any other problematic fields, create any index which has runtime fields or `constant keywords` but does not have anything within the `_source` document using dev tools. For example you can use `constant keyword` like so

```json
PUT constant-keywords-deleme
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "testing_ignored": {
        "properties": {
          "constant": {
            "type": "constant_keyword",
            "value": "constant_value"
          }
        }
      },
      "testing_regex": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "normal_constant": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "small_field": {
        "type": "keyword",
        "ignore_above": 10
      }
    }
  }
}

PUT constant-keywords-deleme/_doc/1
{
  "@timestamp": "2021-09-02T04:20:01.760Z"
}
```

Set in your `kibana.yml` the key/value of:

```yml
xpack.securitySolution.alertIgnoreFields: ['testing_ignored.constant', '/.*_regex/']
```

Setup a rule to run:
<img width="1083" alt="Screen Shot 2021-09-01 at 10 23 23 PM" src="https://user-images.githubusercontent.com/1151048/131781696-fea0d421-836f-465c-9be6-5289fbb622a4.png">

Once it runs you should notice that the constant values for testing are not on the signals table since it only typically exists in the fields API:
<img width="1166" alt="Screen Shot 2021-09-01 at 10 26 16 PM" src="https://user-images.githubusercontent.com/1151048/131781782-1684fb1d-bed9-4cf0-be9a-0abe1f0f34d1.png">

But the normal one still exists:
<img width="1136" alt="Screen Shot 2021-09-01 at 10 26 31 PM" src="https://user-images.githubusercontent.com/1151048/131781827-5450c693-de9e-4285-b082-9f7a2cbd5d07.png">

If you change the `xpack.securitySolution.alertIgnoreFields` by removing it and re-generate the signals you will see these values added back.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/master/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)

Co-authored-by: Frank Hassanabad <[email protected]>

…during alert indexing and a workaround for an EQL bug (#110927) (#111161)

Adds a workaround for EQL bug: elastic/elasticsearch#77152
Adds the safety feature mentioned here: #110802

Adds the ability to ignore particular [fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) when the field is merged with [_source](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#source-filtering). Also fixes an EQL bug where EQL is introducing the meta field of `_ignored` within the fields and causing documents to not be indexable when we merge with the fields from EQL.

Alerting document creation uses the fields API to get [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html),  [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type), etc... that are only available within the [fields API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) and then merges the field values not found within the `_source` document with the `_source` document and then finally indexes this merged document as an alert document.

This fix/ability is a "safety feature" in that if a problematic [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html), [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type) is discovered or another bug along the stack we can set a `kibana.yml` key/value pair to ignore the problematic field.

This _WILL NOT_ remove problematic fields from the `_source` document. This will only ignore problematic constant keyword, runtime fields, aliases, or anything else found in the fields API that is causing merge issues.

This PR:
  * Adds a `alertIgnoreFields` `kibana.yml` array key with a default of an empty array if not specified.
  * Plumbs the `alertIgnoreFields` through the stack and into the fields/_source merge strategies of `missingFields` and `allFields`
  * Adds a temporary `isEqlBug77152` where it hard codes an ignore of `_ignored` until the EQL problem is fixed and then we will remove the workaround
  * Adds unit tests
  * Adds e2e tests which covers the described use cases above.

The `alertIgnoreFields` key/value within `kibana.yml` if set should be an array of strings of each field you want to ignore. This can also contain regular expressions as long as they are of the form, `"/regex/"` in the array.

Example if you want to ignore fields that are problematic called "host.name" and then one in which you want to ignore all fields that start with "user." using a regular expression:

```yml
xpack.securitySolution.alertIgnoreFields: ['host.name', '/user\..*/']
```

Although there are e2e tests which exercise the use cases...

If you want to manual test the EQL bug fix you would add these documents in dev tools:

```json
DELETE eql-issue-ignore-fields-delme
PUT eql-issue-ignore-fields-delme
{
  "mappings" : {
    "dynamic": "strict",
    "properties" : {
      "@timestamp": {
        "type": "date"
      },
      "some_keyword" : {
        "ignore_above": 5,
        "type" : "keyword"
      },
      "other_keyword" : {
        "ignore_above": 10,
        "type" : "keyword"
      }
    }
  }
}

PUT eql-issue-ignore-fields-delme/_doc/1
{
  "@timestamp": "2021-09-02T04:13:05.626Z",
  "some_keyword": "longer than normal",
  "other_keyword": "normal"
}
```

Then create an alert which queries everything from it:
<img width="1155" alt="Screen Shot 2021-09-01 at 10 15 06 PM" src="https://user-images.githubusercontent.com/1151048/131781042-faa424cf-65a5-4ebb-b801-3f188940c81d.png">

and ensure signals are created:
<img width="2214" alt="Screen Shot 2021-09-01 at 10 30 18 PM" src="https://user-images.githubusercontent.com/1151048/131782069-b9ab959c-f22d-44d5-baf0-561fe349c037.png">

To test the manual exclusions of any other problematic fields, create any index which has runtime fields or `constant keywords` but does not have anything within the `_source` document using dev tools. For example you can use `constant keyword` like so

```json
PUT constant-keywords-deleme
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "testing_ignored": {
        "properties": {
          "constant": {
            "type": "constant_keyword",
            "value": "constant_value"
          }
        }
      },
      "testing_regex": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "normal_constant": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "small_field": {
        "type": "keyword",
        "ignore_above": 10
      }
    }
  }
}

PUT constant-keywords-deleme/_doc/1
{
  "@timestamp": "2021-09-02T04:20:01.760Z"
}
```

Set in your `kibana.yml` the key/value of:

```yml
xpack.securitySolution.alertIgnoreFields: ['testing_ignored.constant', '/.*_regex/']
```

Setup a rule to run:
<img width="1083" alt="Screen Shot 2021-09-01 at 10 23 23 PM" src="https://user-images.githubusercontent.com/1151048/131781696-fea0d421-836f-465c-9be6-5289fbb622a4.png">

Once it runs you should notice that the constant values for testing are not on the signals table since it only typically exists in the fields API:
<img width="1166" alt="Screen Shot 2021-09-01 at 10 26 16 PM" src="https://user-images.githubusercontent.com/1151048/131781782-1684fb1d-bed9-4cf0-be9a-0abe1f0f34d1.png">

But the normal one still exists:
<img width="1136" alt="Screen Shot 2021-09-01 at 10 26 31 PM" src="https://user-images.githubusercontent.com/1151048/131781827-5450c693-de9e-4285-b082-9f7a2cbd5d07.png">

If you change the `xpack.securitySolution.alertIgnoreFields` by removing it and re-generate the signals you will see these values added back.

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/master/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)

…during alert indexing and a workaround for an EQL bug (#110927) (#111174)

## Summary

Adds a workaround for EQL bug: elastic/elasticsearch#77152
Adds the safety feature mentioned here: #110802

Adds the ability to ignore particular [fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) when the field is merged with [_source](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#source-filtering). Also fixes an EQL bug where EQL is introducing the meta field of `_ignored` within the fields and causing documents to not be indexable when we merge with the fields from EQL.

Alerting document creation uses the fields API to get [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html),  [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type), etc... that are only available within the [fields API](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html#search-fields-param) and then merges the field values not found within the `_source` document with the `_source` document and then finally indexes this merged document as an alert document.

This fix/ability is a "safety feature" in that if a problematic [runtime field](https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime.html), [constant keyword](https://www.elastic.co/guide/en/elasticsearch/reference/master/keyword.html#constant-keyword-field-type) is discovered or another bug along the stack we can set a `kibana.yml` key/value pair to ignore the problematic field.

This _WILL NOT_ remove problematic fields from the `_source` document. This will only ignore problematic constant keyword, runtime fields, aliases, or anything else found in the fields API that is causing merge issues.

This PR:
  * Adds a `alertIgnoreFields` `kibana.yml` array key with a default of an empty array if not specified.
  * Plumbs the `alertIgnoreFields` through the stack and into the fields/_source merge strategies of `missingFields` and `allFields`
  * Adds a temporary `isEqlBug77152` where it hard codes an ignore of `_ignored` until the EQL problem is fixed and then we will remove the workaround
  * Adds unit tests
  * Adds e2e tests which covers the described use cases above.

The `alertIgnoreFields` key/value within `kibana.yml` if set should be an array of strings of each field you want to ignore. This can also contain regular expressions as long as they are of the form, `"/regex/"` in the array.

Example if you want to ignore fields that are problematic called "host.name" and then one in which you want to ignore all fields that start with "user." using a regular expression:

```yml
xpack.securitySolution.alertIgnoreFields: ['host.name', '/user\..*/']
```

Although there are e2e tests which exercise the use cases...

If you want to manual test the EQL bug fix you would add these documents in dev tools:

```json
# Delete and add a mapping with a small ignore_above.
DELETE eql-issue-ignore-fields-delme
PUT eql-issue-ignore-fields-delme
{
  "mappings" : {
    "dynamic": "strict",
    "properties" : {
      "@timestamp": {
        "type": "date"
      },
      "some_keyword" : {
        "ignore_above": 5,
        "type" : "keyword"
      },
      "other_keyword" : {
        "ignore_above": 10,
        "type" : "keyword"
      }
    }
  }
}

# Add a single document with one field that will be truncated and a second that will not.
PUT eql-issue-ignore-fields-delme/_doc/1
{
  "@timestamp": "2021-09-02T04:13:05.626Z",
  "some_keyword": "longer than normal",
  "other_keyword": "normal"
}
```

Then create an alert which queries everything from it:
<img width="1155" alt="Screen Shot 2021-09-01 at 10 15 06 PM" src="https://user-images.githubusercontent.com/1151048/131781042-faa424cf-65a5-4ebb-b801-3f188940c81d.png">

and ensure signals are created:
<img width="2214" alt="Screen Shot 2021-09-01 at 10 30 18 PM" src="https://user-images.githubusercontent.com/1151048/131782069-b9ab959c-f22d-44d5-baf0-561fe349c037.png">

To test the manual exclusions of any other problematic fields, create any index which has runtime fields or `constant keywords` but does not have anything within the `_source` document using dev tools. For example you can use `constant keyword` like so

```json
PUT constant-keywords-deleme
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "testing_ignored": {
        "properties": {
          "constant": {
            "type": "constant_keyword",
            "value": "constant_value"
          }
        }
      },
      "testing_regex": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "normal_constant": {
        "type": "constant_keyword",
        "value": "constant_value"
      },
      "small_field": {
        "type": "keyword",
        "ignore_above": 10
      }
    }
  }
}

PUT constant-keywords-deleme/_doc/1
{
  "@timestamp": "2021-09-02T04:20:01.760Z"
}
```

Set in your `kibana.yml` the key/value of:

```yml
xpack.securitySolution.alertIgnoreFields: ['testing_ignored.constant', '/.*_regex/']
```

Setup a rule to run:
<img width="1083" alt="Screen Shot 2021-09-01 at 10 23 23 PM" src="https://user-images.githubusercontent.com/1151048/131781696-fea0d421-836f-465c-9be6-5289fbb622a4.png">

Once it runs you should notice that the constant values for testing are not on the signals table since it only typically exists in the fields API:
<img width="1166" alt="Screen Shot 2021-09-01 at 10 26 16 PM" src="https://user-images.githubusercontent.com/1151048/131781782-1684fb1d-bed9-4cf0-be9a-0abe1f0f34d1.png">

But the normal one still exists:
<img width="1136" alt="Screen Shot 2021-09-01 at 10 26 31 PM" src="https://user-images.githubusercontent.com/1151048/131781827-5450c693-de9e-4285-b082-9f7a2cbd5d07.png">

If you change the `xpack.securitySolution.alertIgnoreFields` by removing it and re-generate the signals you will see these values added back.

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- [x] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/master/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)

# Conflicts:
#	src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/create_security_rule_type_factory.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/utils/build_bulk_body.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/factories/wrap_hits_factory.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/indicator_match/create_indicator_match_alert_type.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/indicator_match/create_indicator_match_alert_type.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/ml/create_ml_alert_type.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/ml/create_ml_alert_type.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/query/create_query_alert_type.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/types.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_bulk_body.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.test.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/signal_rule_alert_type.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/wrap_hits_factory.ts
#	x-pack/plugins/security_solution/server/lib/detection_engine/signals/wrap_sequences_factory.ts
#	x-pack/plugins/security_solution/server/plugin.ts
#	x-pack/test/detection_engine_api_integration/security_and_spaces/tests/index.ts