Add search runtime_mappings to datafeed configuration

[davidkyle]

This change adds runtime fields in search to the datafeed.

The DatafeedConfig has an optional section to defined search runtime fields

            "runtime_mappings" : {
                "rt_field_1": {
                    "type": "double",
                    "script": "emit(doc['some_field'].value * 100.0)"
                },
                "rt_field_2": {
                    "type": "double",
                    "script": "emit(doc['another_field'].value)"
                },

The actual configuration is just a loose Map<String, Object> as this is what SearchSourceBuilder uses. There is some validation on PUT that the map contents resemble a runtime_mappings configuration.

Datafeed preview and running a datafeed are not exactly the same. The checks in DatafeedJobValidator are not run in preview which means the check that the time field is not an RT field will not happen. We should discuss changing preview to exactly match the behaviour or running a datafeed.

There are some design decisions that the reviewer should know about:

1. Configurations of jobs/datafeeds that use runtime_mappings to create the job time field will be rejected.
2. RT fields do no work with v1 Rollup searches. If the datafeed is querying a rollup index it will not start if RT fields are used.
3. RT fields in Cross Cluster Search require the remote cluster to be v7.11 or above. The datafeed will start and the search will fail in this case. It is not possible to check prior to starting the datafeed.

HLRC to follow, this change is big enough.

[elasticmachine]

Pinging @elastic/ml-core (:ml)

[droberts195]

Looks good.

I just had a few minor nits.

[droberts195]

It might be better to say object instead of map in this error message, as the user reading the message is thinking of the JSON structure rather than the Java structure.

[davidkyle]

map is consistent with the language used here

elasticsearch/server/src/main/java/org/elasticsearch/index/mapper/RuntimeFieldType.java

Line 91 in af2f084

throw new MapperParsingException("Expected map for runtime field [" + fieldName + "] definition but got a "

[droberts195]

It's still wrong - the word "map" does not appear anywhere in this page: https://www.json.org/json-en.html

It sounds like there is going to be a separate PR to correct this throughout the runtime fields code though, so all instances can be fixed in one go.

[droberts195]

LGTM