Added statistics discover template

[Machi3mfl]

Hi Team, this resolves

• Adding wazuh-statistics index template and mapping

Test suit:

Note: in order to get statistics with a short frequency, you could set these configs in your wazuh.yml

cron.statistics.index.creation: 'h'
cron.statistics.interval: '0/5 * * * * *'

• The new template wazuh-statistics should be generated
  
• The new template should support a custom cron.index and cron.statistics.index.name
• The new statistics docs should be mapped correctly
  
• The statictis views should work correctly

Closes #3072

[gabiwassan]

LGTM!

[Desvelao]

Fix typo this indices to these indices.

[pablomarga]

These fields should be added to public/utils/statistics-fields.ts:

{ "name": "_id", "type": "string", "count": 0, "scripted": false, "searchable": true, "aggregatable": true, "readFromDocValues": false },
{ "name": "_index", "type": "string", "count": 0, "scripted": false, "searchable": true, "aggregatable": true, "readFromDocValues": false },
{ "name": "_score", "type": "number", "count": 0, "scripted": false, "searchable": false, "aggregatable": false, "readFromDocValues": false },
{ "name": "_source", "type": "_source", "count": 0, "scripted": false, "searchable": false, "aggregatable": false, "readFromDocValues": false },
{ "name": "_type", "type": "string", "count": 0, "scripted": false, "searchable": true, "aggregatable": true, "readFromDocValues": false },

Due to if you had a previously created index pattern, it may not have the _source mapping field and it will make the entire document look like a JSON in Discover instead of highlighting the fields of the object

[Desvelao]

Testing
✅ Create wazuh-statistics template
✅ Create indices with new mapping
❌ Some visualizations in Management > Statistics are not displayed. This maybe could related to the change in remoted and analisysd from type [{remoted|analisyd}] to {remoted|analisyd} ?

❗ The file with the known fields for statistics needs to be updated with the same field mapping public/utils/statistics-fields.ts. Some meta fields are missing in the know fields as _id, _index, _score, _source and _type. The _source metafield is important to display the formatted fields like the screenshot:

[pablomarga]

Testing
✅ Create wazuh-statistics template
✅ Create indices with new mapping
❌ Some visualizations in Management > Statistics are not displayed. This maybe could related to the change in remoted and analisysd from type [{remoted|analisyd}] to {remoted|analisyd} ?

Everything mentioned by @Desvelao is also happening to me

[Desvelao]

Changes

• Fixed the statistics visualizations expressions replacing all the instances of wazuh-statistics-* index placeholder instead of the first one.
• Fixed the template for wazuh-statistics indices when using a custom name for the indices instead of statistics. Now add the index pattern to the template correctly.

[frankeros]

LGTM!

[pablomarga]

Tested it and seems to work as expected. Great job! LGTM!