Add ability to detect if index-pattern implements ECS

[thomasneirynck]

It would be useful if we could determine if an index-pattern implements ECS.

This is especially relevant because ECS has tighter semantics on some of the fields.

e.g. in ECS (https://www.elastic.co/guide/en/ecs/current/ecs-geo.html), the *.geo.country_iso_code and *.geo.region_iso_code fields contain iso-3166-1 and iso-3166-2 identifiers respectively. The UX can use these for initializing configurations for maps with countries or provinces/states/... without requiring the user to manually configure this.

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)

[mattkime]

This definitely sounds like something index patterns should help with.

Index pattern content is very closely tied to the _field_caps api call. It would be helpful if the info we needed somehow fit into its results. It certainly should be available somewhere in ES since index pattern lists need to be regenerated.

Maybe we can figure out how this might work and take a guess at the effort level. Then we can place it on the roadmap.

[thomasneirynck]

thanks @mattkime ,happy to help evaluate this. Maps would have an immediate use for it. We're adding more&more layer-templates to Maps (e.g. SIEM, APM, ...), which aim to "auto-magically" configure layers requiring the least manual intervention. The latest example is where this would be useful would be here #69699

[thomasneirynck]

Maps introduced a utility that added some heuristic for the geo-field names #94969, to determine if they match ECS-geo-field names.

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)