[EventLog] make use of EQL in event log query

[pmuellr]

While working on PR #57446, I noticed in the weekly ES updates a note about EQL, and decided to take a look:

• https://www.elastic.co/guide/en/elasticsearch/reference/master//eql-search.html

I think we can take advantage of this in some follow-on work to the PR referenced above. That PR is adding a new API to get alert "status", but is consuming a potentially large number of event log documents from a flat time-based query. It seems likely we could create an EQL query to do some of this work for us, cutting down on the amount of data transferred and perhaps making the semantics a bit clearer (in EQL instead of TS).

One particular example that would be nice to "solve", is when a missing resolved-instance message would get lost, the referenced PR will end up reporting that instance as active. You can "see" looking at the documents that it's not really active, if there have been multiple execute documents since the last active-instance message, but that's difficult to precisely describe in JS whereas might be pretty easy to describe as an EQL sequence

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[YulNaumenko]

@pmuellr We currently have a support of KQL queries. #89082
Do you think we still need this issue opened?

[pmuellr]

EQL would let you do searches over a sequence of events, which seems like it could be useful:
https://www.elastic.co/guide/en/elasticsearch/reference/master/eql.html#eql-search-sequence

I was actually thinking of trying to use it to capture the new-instance / recovered-instance pairs, but I didn't get far into that.

Probably worth closing though. I don't think we have any requirement for it that I know of.