Summary

In this PR, we use dataViewLazy, which avoids calling _field_caps API (this logic was introduced in this PR).

Questions

1. Do we need to call _field_caps API in the log threshold rule executor? If yes, in which scenario?
   No, we don't need to call _field_caps API in rule execution.
2. How to fix the type issues since DataViewLazy misses some fields that exist in the DataView type.
   We decided to use DataViewLazy everywhere on the server side but convert it to an actual DataView on the client side due to the need for the fields.

	Screenshot
Create
createDataViewLazy

🧪 How to test

• Enable APM locally

elastic.apm.active: true
elastic.apm.transactionSampleRate: 1.0
elastic.apm.environment: username

• Create a log threshold rule and check its execution in traces filtered for your username as the environment. There should be one with your rule name:
  

  The timing for _field_caps would be more if you replace the createDataViewLazy with the create function.