[BUG] AD timefield name issue with PPL Query

[ps48]

What is the bug?
AD command only takes in field name as timestamp for the timefield parameter. Any other name invalidates the date field in output.

How can one reproduce the bug?
Steps to reproduce the behavior:

• NOTE: Data set used sample data logs from OpenSearch Dashboards: opensearch_dashboards_sample_data_logs

• Timefield named ts doesn't work as expected:

source = opensearch_dashboards_sample_data_logs | where match(machine.os,'win')  |stats avg(machine.ram) as avg_ram by span(timestamp,1d) as ts | fields ts, avg_ram | AD time_field='ts'

Output:
{
  "schema": [
    {
      "name": "ts",
      "type": "timestamp"
    },
    {
      "name": "avg_ram",
      "type": "double"
    },
    {
      "name": "score",
      "type": "double"
    },
    {
      "name": "anomaly_grade",
      "type": "double"
    },
    {
      "name": "timestamp",
      "type": "timestamp"
    }
  ],
  "datarows": [
    [
      "2022-08-14 00:00:00",
      1.2099412902657719E10,
      0.0,
      0.0,
      null
    ],
    [
      "2022-08-15 00:00:00",
      1.2246881383884058E10,
      0.0,
      0.0,
      null
    ],
    [
      "2022-08-16 00:00:00",
      1.3002572224876713E10,
      0.0,
      0.0,
      null
    ],
    [
      "2022-08-17 00:00:00",
      1.2276220217070065E10,
      0.0,
      0.0,
      null
    ],
],
  "total": 4,
  "size": 4
}

• Timefield names as timestamp works as expected:

source = opensearch_dashboards_sample_data_logs | where match(machine.os,'win')  |stats avg(machine.ram) as avg_ram by span(timestamp,1d) as timestamp | fields timestamp, avg_ram | AD time_field='timestamp'

Output:
{
  "schema": [
    {
      "name": "timestamp",
      "type": "timestamp"
    },
    {
      "name": "avg_ram",
      "type": "double"
    },
    {
      "name": "score",
      "type": "double"
    },
    {
      "name": "anomaly_grade",
      "type": "double"
    }
  ],
  "datarows": [
    [
      "2022-08-14 00:00:00",
      1.2099412902657719E10,
      0.0,
      0.0
    ],
    [
      "2022-08-15 00:00:00",
      1.2246881383884058E10,
      0.0,
      0.0
    ],
    [
      "2022-08-16 00:00:00",
      1.3002572224876713E10,
      0.0,
      0.0
    ],
    [
      "2022-08-17 00:00:00",
      1.2276220217070065E10,
      0.0,
      0.0
    ]
],
  "total": 4,
  "size": 4
}

What is the expected behavior?
A clear and concise description of what you expected to happen.

What is your host/environment?

• OS: Ubuntu-Linux
• Version: 2.3.0

Do you have any screenshots?

• Bug recreated with timefield namedts
  

• Works with timefield namedtimestamp
  

Do you have any additional context?

• AD PPL command documentation

[jngz-es]

opensearch-project/sql#919