196040 automatic import ensure the timestamp field is present

[haetamoudi]

Summary

Enforce @timestamp in mapping returned by LLM. #196040

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines

[elasticmachine]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!

[haetamoudi]

If the LLM cannot map any field to @timestamp it will retry multiple times.
I initially wanted to break out of the loop if the logs sample did not have any datetime fields, however datetime can come in multiple formats, and the logic was not very reliable e.g:

2023-10-01T12:34:56Z
2023-10-01T12:34:56.123Z
2023-10-01T12:34:56+00:00
2023-10-01T12:34:56.123+00:00
2023-10-01T12:34:56.123456789Z
2023-10-01 12:34:56
10/01/2023 12:34:56
01-10-2023 12:34:56
2023-10-01T12:34:56.123456789+00:00
2023-10-01T12:34:56.123456789-07:00

Any thoughts?

[haetamoudi]

Is that really necessary now that the @timestamp was added to the ECS_FIELDS in constants.ts?