[FEATURE]Support OpenSearch timestamp in Observability

[jackiehanyang]

Is your feature request related to a problem? Cannot run PPL query that has an OpenSearch timestamp type in it's index mapping in Observability.

What solution would you like? Support OpenSearch timestamp in Observability

What alternatives have you considered? A clear and concise description of any alternative solutions or features you've considered.

Do you have any additional context? Add any other context or screenshots about the feature request here.

[penghuo]

Thanks for raising the issue! Could you post one example for helping understand the use cases?

[mengweieric]

Adding more info here to clarify the problem.

If a timestamp for an index has a format set with non epoch_millis value(s), queries contain this timestamp as selected time range would fail with 503.

For example, this is the index mappings that would lead to having the above issue:

 "nyc_taxi" : {
  "mappings" : {
   "properties" : {
    "anomaly_type" : {
     "type" : "keyword"
    },
    "timestamp" : {
     "type" : "date",
     "format" : "yyyy-MM-dd HH:mm:ss" // has a format
    },
    "value" : {
     "type" : "float"
    }
   }
  }
 }
}

However removing the format or adding ||epoch_millis to the format in the index mappings seem to avoid having this issue.

// Both worked

"timestamp" : {
   "type" : "date"
 }

or

"timestamp" : {
   "type" : "date",
    "format" : "yyyy-MM-dd HH:mm:ss||epoch_millis"
 }