Handle closed indices in search stats endpoint query

[margaretpearce]

What does this PR do?

• Update the query to get stats for searches by index to handle closed indices instead of returning an error

Motivation

Elasticsearch 7.3+ returns an error on /_stats/search if there are closed indices in the cluster: elastic/elasticsearch#88752.

Elasticsearch can have closed indices that are hidden, such as .ds-ilm-history-* and .internal.alerts-observability. These indices are system-managed. However, because these indices can exist and can be closed, they trigger error responses from the query in _get_index_search_stats:

{
	"error": {
		"root_cause": [
			{
				"type": "index_closed_exception",
				"reason": "closed",
				"index_uuid": "xxxxx",
				"index": ".internal.alerts-security.alerts-default-000001"
			}
		],
		"type": "index_closed_exception",
		"reason": "closed",
		"index_uuid": "xxxxx",
		"index": ".internal.alerts-security.alerts-default-000001"
	},
	"status": 400
}

These errors end up being surfaced in the Datadog integration as an AuthenticationError, which is not accurate: https://github.com/DataDog/integrations-core/blob/master/elastic/datadog_checks/elastic/elastic.py#L341

To resolve this problem, I considered two options:

1. Gather stats from closed indices by passing query parameter forbid_closed_indices=false (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-stats#operation-indices-stats-forbid_closed_indices)
2. Skip stats on closed indices by passing query parameter ignore_unavailable=true

I opted to pursue the first option because although the second option worked for me, it is not documented on https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-stats.

This is my first contribution to this repository. Apologies for any mistakes or omissions.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.05%. Comparing base (6250e42) to head (bb7e71d).

Additional details and impacted files

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.