[DataView] Improve automatic timeFieldName selection

[kertal]

When creating a ad-hoc data view in the UI in a quick way, not using the flyout, there's a check if there's a @timestamp field available with the right mapping. In this case this is automatically selected as timeFieldName in the create data view. This logic is duplicated in several places. So it should be centralized (e.g. as a helper function in dataViews or a method of a data view instance).

Here's some code using this logic:

kibana/src/plugins/discover/public/application/main/services/discover_state.ts

Line 399 in 2d8a2b5

newDataView.timeFieldName = '@timestamp';

kibana/x-pack/plugins/lens/public/app_plugin/lens_top_nav.tsx

Line 944 in 2ed0123

dataView.timeFieldName = '@timestamp';

kibana/x-pack/plugins/stack_alerts/public/rule_types/components/data_view_select_popover.tsx

Line 129 in 32cf768

newDataView.timeFieldName = '@timestamp';

Furthermore this logic could be improved to

• Select a data field if there's just a single one in the mapping
• Check for more fields like @timestamp ... e.g. timestamp
• Take ECS fields into the consideration

On the long run, it would be helpful to suggest matching fields for timeFieldName, and let the user select it. Or maybe also allow to quickly switch the time field in the field list.

Surfaced in #152640 (comment) index pattern management would also be a good candidate for applying the shared logic

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[kertal]

Closing this because it's not planned to be resolved in the foreseeable future. It will be tracked in our Icebox and will be re-opened if our priorities change. Feel free to re-open if you think it should be melted sooner.