[DataViews] Evaluate switching logs.alert.document.count alerting rule to make use of DataViewLazy

[kertal]

When DataViewLazy is implemented (#167750), the logs.alert.document.count rule should be evaluated to consume this new class. The benefit of it is that it's no longer triggering a request for fields (field_caps request to ES) when being initialized. When fields are not needed for the rule execution, this saves a lot of redundant requests to Elasticsearch.

Here's the code to investigate:

kibana/x-pack/plugins/observability_solution/infra/server/lib/alerting/log_threshold/log_threshold_executor.ts

Lines 203 to 210 in ad272c2

	const { indices, timestampField, runtimeMappings } = await logsShared.logViews
	.getClient(savedObjectsClient, scopedClusterClient.asCurrentUser)
	.getResolvedLogView(validatedParams.logView);
	if (!isRatioRuleParams(validatedParams)) {
	await executeAlert(
	validatedParams,
	timestampField,

Resolving the data view, which leads to a field_caps request is being used in rules execution and UI, and can be found here:

kibana/x-pack/plugins/observability_solution/logs_shared/common/log_views/resolved_log_view.ts

Lines 30 to 40 in 34e03d1

	export const resolveLogView = (
	logViewId: string,
	logViewAttributes: LogViewAttributes,
	dataViewsService: DataViewsContract,
	config: LogViewsStaticConfig
	): Promise<ResolvedLogView> => {
	if (logViewAttributes.logIndices.type === 'index_name') {
	return resolveLegacyReference(logViewId, logViewAttributes, dataViewsService, config);
	} else {
	return resolveDataViewReference(logViewAttributes, dataViewsService);
	}

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[elasticmachine]

Pinging @elastic/obs-ux-infra_services-team (Team:obs-ux-infra_services)

[elasticmachine]

Pinging @elastic/obs-ux-management-team (Team:obs-ux-management)

[kertal]

@smith this should be unblocked no, since @mattkime merged #173948

[jasonrhodes]

We should check to see if we also need to do this for Custom Threshold Rule where we also allow data view usage