[Schema]Update Observability Indices with Fields sorting

[YANG-DB]

Which domain protocol is relevant for this schema ?

Add support for index template predetermined sort fields:

When creating a new index in Opensearch it is possible to configure how the Segments inside each Shard will be sorted. By > default Lucene does not apply any sort. The index.sort.* settings define which fields should be used to sort the documents inside each Segment.

For example in the trace.mapping use the following sort fields:

  "settings": {
    "index": {
      "sort.field": [ "@timestamp", "traceId" ], 
      "sort.order": [ "asc", "asc" ]       
    }
  }

What is the schema resource ?

• Traces
• Metrics
• Services
• Logs

Describe the schema resource you are interested in update or create and attach a link to the schema resource

Source Schema - Add necessary repository

• OTEL
• OCSF

---

Do you have any additional context?

Index sorting can be useful in order to organize Lucene doc ids (not to be conflated with _id) in a way that makes conjunctions (a AND b AND …​) more efficient.
This only works with low-cardinality fields, you should sort first on fields that both have a low cardinality and are frequently used for filtering. The sort order actually doesn't matter as it only care about putting values that would match the same clauses close to each other.