Allow use of _index in field aggregations.

Allow use of _index in field aggregations.

## What?

At present using Graylog search language, you can search by _index.

However in aggregations you cannot. _index is not a field in the message, but if it's accessible to the search language it shouldn't be a great reach to make it accessible to aggregations also.

## Why?

Users are seeking insights into either their Elasticsearch usage, to inform better optimisations around sharding and rotation policy.

Enterprise customers are seeking insights into their licsence usage.

This seems like a basic tool that is missing, for use in introspective dashboards.

## Your Environment
Graylog 4.2