Add 2+ level aggregations PPL command

[anasalkouz]

support multiple level aggregations using stats command:

Let's assume index named logs with the following fields:

• timestamp: The time of the log event
• host: The hostname of the machine
• service: The service name
• response_time: The response time of the service

Perform a two-level aggregation where:

• First aggregate the average response_time by host.
• Then aggregate the average of these average response times by service.

source=logs
   | stats avg(response_time) as avg_response_time by host, service
   | stats avg(avg_response_time) as avg_host_response_time by service

Details:

First Level Aggregation:
The first stats command calculates the average response_time for each host and service combination.

source=logs
   | stats avg(response_time) as avg_response_time by host, service

Second Level Aggregation:
The second stats command then takes the result of the first aggregation and calculates the average of these average response times grouped by service.

   | stats avg(avg_response_time) as avg_host_response_time by service