[Observability] Metric Threshold Rule Should Allow Specifying Indices

[MakoWish]

Describe the feature:

Allow specifying indices in the Metric Threshold rules.

Describe a specific use case for the feature:

Currently, the Metric Threshold rule does not allow specifying which indices should be queried. This seems like a waste of resources querying dozens (or potentially even hundreds?) of metrics-* indices when we may only be interested in, for example, metrics-system.cpu-* for a CPU threshold rule. This also seems counterintuitive to the entire "Namespaces" idea with Data Streams. For instance, if our Application Development team's servers (they have their own space) are writing to metrics-system.<dataset>-appdev, and our Facilities team's servers (they also have their own space) are writing to metrics-system.<dataset>-facilities, we should be able to specify on their Metrics Threshold rules to only search their namespaces. Anything else is again a waste of resources.

[consulthys]

Beautiful idea! In the meantime, you can add a filter to the rule, e.g., data_stream.dataset: "system.cpu", in order for the rule to focus only on the relevant data streams... Since data_stream.dataset is a constant_keyword, the filtering should be pretty efficient even if you have several hundreds of metrics-* data stream.

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)