[Lens] Implement a last value - first value shortcut function

[wylieconlon]

We decided not to implement a first_value function in Lens because we could only identify one use case, which is last value - first value. We don't have a good name for this type of function, but it's used primarily when looking timestamped summaries of data. For example in https://discuss.elastic.co/t/display-aggregated-counter-value-per-interval/272333/7 the user is looking at a counter-type number (issues) where it's important to ignore duplicates. Using last/first value guarantees that issues are counted once.

The implementation of this shortcut function requires us to implement a "first value" concept, but this should not be exposed in the quick functions- it only makes sense within the context of this shortcut function or as a formula.

Use Cases

• Formula: Time between calculations
• Only counting something once

[elasticmachine]

Pinging @elastic/kibana-app (Team:KibanaApp)

[dej611]

+1 https://discuss.elastic.co/t/how-to-calculate-elapsed-time-between-timestamps-in-a-given-timerange/283449/2

[timductive]

This is useful but the question is should we implement in Lens formula or put on the ESQL roadmap.

[stratoula]

The ES team confirmed that they are going to support last and first value either with an aggregation or an eval function so I am changing the impact to low as with ESQL we will have it out of the box.

[markov00]

In order to provide better transparency of priorities, issues that will not be prioritized within the next 24 months are being closed.

Tracking request in Lens general improvements ice box, solvable possibly with ESQL #184648