[ES|QL] Convert some of the sample data to use ES|QL

[stratoula]

Describe the feature:

One of the best ways to train our users to use ES|QL is our sample datasets. We could use the kibana_sample_data_logs dataset and convert all the installed SOs to use ES|QL instead of the search api

I think we can start with the saved search and the dashboard. (and possibly the map too, I need to discuss with the maps team)

The saved search can be converted already but the dashboard needs the inlinestats command to unlock everything.

[elasticmachine]

Pinging @elastic/kibana-presentation (Team:Presentation)

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[elasticmachine]

Pinging @elastic/kibana-esql (Team:ESQL)

[elasticmachine]

Pinging @elastic/kibana-visualizations (Team:Visualizations)

[stratoula]

I am pinging all the teams for visibility.

[nreese]

I would recommend avoid converting maps until ES|QL spatial is GA. Also, ES|QL spatial is lacking grid aggregation functions used in the web logs map.

[stratoula]

Gotcha, thanx Nathan! Let's start with the Lens visualizations and the saved searches then

[stratoula]

Here is the sample data logs dashboard with ES|QL. I have converted all the Lens visualizations to ES|QL and not the map.

esql-logs-dashboard.txt

[stratoula]

Here is the sample data logs Discover saved search with ES|QL

esql-logs-discover-view.txt

PS: We could also introduce a second saved search that uses aggregations just to showcase that now Discover also supports aggregations.

[stratoula]

I am marking it as blocked for now as the dashboard requires inlinestats and is not currently available to regular releases.