Using index in expressions has a common chance of creating an invalid index

[graytaylor0]

Is your feature request related to a problem? Please describe.
Users often format the index with values from the Event or EventMetadata, and this can commonly lead to invalid index names that don't follow the guidelines below

OpenSearch Service indexes have the following naming restrictions:

    All letters must be lowercase.

    Index names cannot begin with _ or -.

    Index names can't contain spaces, commas, :, ", *, +, /, \, |, ?, #, >, or <.

**Describe the solution
Have the index parameter always conform to a valid index naming. The index will always take what is given and perform the following operations. This could be enabled with a separate flag enforce_valid_index: true or normalize_index: true

1. Make lowercase
2. Replace starting _ or - with `` (should this character be configurable?)
3. Replace invalid characters with _ (should this character be configurable?)

Alternatives

• Create expression functions that will do this getValidIndex or getValidIndexMetadata

[dlvenable]

I think normalize_index is clearer. The term "enforce" indicates that it would validate the index name and then fail if it is invalid.

Another name could be auto_correct_index.

I think a parameter would be easier to use than an expression function.

[graytaylor0]

I'm leaning towards normalize_index but auto_correct_index is good as well