[Logs UI] Create ML module for log analysis

[weltenwort]

Summary

The job that produces the data displayed on the log analysis screen (#41881) should be defined in and deployed via an ML module along with the corresponding datafeed.

Acceptance criteria

• A new ML module is created that is owned by the Logs UI.
• The module contains an ML job with the following characteristics:
  • The job id is deterministically derived from the space id and the source id, so it can be easily discovered later. It could be something like kibana-logs-ui-${spaceId}-${sourceId}-log-entry-rate.
  • The job is a time series analysis job with the time field being based on the source configuration.
  • The detector uses the count function.
  • The model plot functionality is enabled.
  • The bucket span is chosen as a compromise between storage size and precision. The ML team's recommendations are about 15 minutes, but not lower than that.
• The module contains a corresponding datafeed:
  • The datafeed id is also deterministically derived from the space id and the source id.
  • The indices are based on the logs indices from source configuration.

Implementation notes

• The indices and timestamp fields are overridden on setup via the enhanced ML module setup API ([ML] Allow for injection of job parameters upon module setup #42409).

Example job and datafeed configurations

⚠️ these are just examples and do not necessarily match the final configurations

{
  "job_id": "kibana-logs-ui-testspace-default-log-entry-rate",
  "analysis_config": {
    "bucket_span": "15m",
    "summary_count_field_name": "doc_count",
    "detectors": [
      {
        "detector_description": "count",
        "function": "count",
        "detector_index": 0
      }
    ],
    "influencers": []
  },
  "data_description": {
    "time_field": "@timestamp",
    "time_format": "epoch_ms"
  },
  "model_plot_config": {
    "enabled": true
  }
}

{
  "datafeed_id": "datafeed-kibana-logs-ui-testspace-default-log-entry-rate",
  "job_id": "kibana-logs-ui-testspace-default-log-entry-rate",
  "indices": [
    "filebeat-*"
  ]
}

[elasticmachine]

Pinging @elastic/infra-logs-ui