OpenSearch does not have thread pool with the name bulk. However,
there is a field named "write" that can be used by bulk or writing
a single instance.

This PR adds the necessary logic to use the OpenSearch data coming
from the exporter and because the expression is big, it was
separated into smaller expressions using record.

To see the original rule that was inspiration for this alert see
this [repo](https://github.com/lukas-vlcek/prometheus-elasticsearch-rules/blob/master/logging_elasticsearch.rules.yaml)

Fix: canonical#503