Copy normalisers for keyword fields to rollup indexes

[colings86]

At the moment rollups do not copy normalisers for keyword fields over to the rollup index. This means that will the introduction of #30973 enabling the match query to be used against rollup indexes the match query will work differently on live indexes to rollup indexes. The difference will be that a match query against a keyword field in a live index will get a configured normaliser applied to the query text and will match documents, but running the same query against a rollup index will potentially not match documents because the normaliser will not be applied to the query text.

For example:
If I have a field that has a lowercasing normaliser on the live index and do a rollup search across live and rollup indexes for mySQL, it will find documents in the live index and return them but it will look like there are no matching documents in the rollup index because the same normalisation was not applied on the rollup index.

We should make a change to the index side of rollups to copy over any normalisers that are configure on keyword fields we are using in the rollups.

[elasticmachine]

Pinging @elastic/es-search-aggs

[jimczi]

We've decided to not allow match queries in rollup at the moment. text fields are not handled in rollups so the need for this type of query is still unclear. We still need to handle normalizer in rollups for keyword field since the term query uses them, I removed the blocker label but we should at least document the limitation.

[wchaparro]

With the 8.7 release of Elasticsearch, we have made a new downsampling capability associated with the new time series datastreams functionality generally available (GA). This capability was in tech preview in ILM since 8.5. Downsampling provides a method to reduce the footprint of your time series data by storing it at reduced granularity. The downsampling process rolls up documents within a fixed time interval into a single summary document. Each summary document includes statistical representations of the original data: the min, max, sum, value_count, and average for each metric. Data stream time series dimensions are stored unchanged.

Downsampling is superior to rollup because:

• Downsampled indices are searched through the _search API
• It is possible to query multiple downsampled indices together with raw data indices
• The pre-aggregation is based on the metrics and time series definitions in the index mapping so very little configuration is required (i.e. much easier to add new time serieses)
• Downsampling is managed as an action in ILM
• It is possible to downsample a downsampled index, and reduce granularity as the index ages
• The performance of the pre-aggregation process is superior in downsampling, as it builds on the time_series index mode infrastructure

Because of the introduction of this new capability, we are deprecating the rollups functionality, which never left the Tech Preview/Experimental status, in favor of downsampling and thus we are closing this issue. We encourage you to migrate your solution to downsampling and take advantage of the new TSDB functionality.