[Discover] For logs, users need to see when, where, what

[ruflin]

To browse logs, users care about 3 main properties: When (timestamp), where (resource), what (content). To have a seamless experience browsing logs, these properties need to be grouped together. Based on ECS, we know what drives these fields. This experience should be available for all logs users independent of the Discover mode.

At first, we can preselect which fields are mapped to resource and content, ideally at some point users should be able to add additional fields that match resources and content.

On the resource fields, it is important that users can take further actions like filter down or jump to the future entity pages in O11y that show more info about the resource.

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[elasticmachine]

Pinging @elastic/obs-ux-logs-team (Team:obs-ux-logs)