Event log to store namespace per saved object

[mikecote]

In preparation for #27004, each saved object within kibana.saved_objects should have their own namespace attribute. With this change kibana.namespace can also be removed.

Current saved object reference mappings (to be enhanced):

kibana/x-pack/plugins/event_log/generated/mappings.json

Lines 87 to 101 in 90e6f2c

	"saved_objects": {
	"properties": {
	"store": {
	"type": "keyword",
	"ignore_above": 1024
	},
	"id": {
	"type": "keyword",
	"ignore_above": 1024
	},
	"type": {
	"type": "keyword",
	"ignore_above": 1024
	}
	},

Current namespace mapping (to be removed):

kibana/x-pack/plugins/event_log/generated/mappings.json

Lines 75 to 78 in 90e6f2c

	"namespace": {
	"type": "keyword",
	"ignore_above": 1024
	},

Note, that we have also decided to remove the store field from the saved object references for now - it was intended to allow saved objects in separate indices (like task manager documents) to be referenced. We've decided to defer that for now, we can add it back later.

The existing search API will need to be updated.

I am kind of wondering if there's an aspect of the kibana.namespace that we want to keep - today I don't think it would ever be useful, except maybe for the case of logging action execution via http requests - the namespace value would be the namespace in the URI. I think we can delete it today, and add it back later if we need to.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

This is probably a good time to check in with folks looking at the Kibana Platform logging meta issue to show them our kibana top-level property, and saved object references in particular. It would be nice to align on these ...