[EventLog] change to use DLM instead of ILM

[pmuellr]

The current version of the event log sets up ILM for the event log indices, but ILM is not available in serverless. DLM is.

I assume we want to use DLM for traditional as well. If not, we'll need a configuration switch to select whether to use ILM or DLM.

It's not clear to me when DLM will be available as well, but looks like it's available now: https://www.elastic.co/guide/en/elasticsearch/reference/current/data-streams-put-lifecycle.html

There's also a potential short-term issue we will probably want to address. In serverless today, when the event log initializes, it tries to create an ILM policy, but fails since ILM is not available. Resulting in a spammy console. We may want to disable ILM

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[pmuellr]

Note that the current ILM policy calls for deleting event log docs after 90 days. Presumably, that means we'd set the DLM options as:

      "lifecycle": {                                        
        "data_retention": "90d"
      }

Should also be release-noted, since customers may have customized the ILM policy we've been using all this time, which would now be ignored. We could also note that that ILM policy can be deleted - or should we attempt to delete it ourselves? We could potentially just update it's _meta with a note as well ...

kibana/x-pack/plugins/event_log/server/es/documents.ts

Lines 38 to 65 in 70676cc

	export function getIlmPolicy() {
	return {
	policy: {
	_meta: {
	description:
	'ilm policy the Kibana event log, created initially by Kibana, but updated by the user, not Kibana',
	managed: false,
	},
	phases: {
	hot: {
	actions: {
	rollover: {
	max_size: '50GB',
	max_age: '30d',
	// max_docs: 1, // you know, for testing
	},
	},
	},
	delete: {
	min_age: '90d',
	actions: {
	delete: {},
	},
	},
	},
	},
	};
	}