Currently the `index.look_ahead_time` index setting controls the `index.time_series_end_time` index setting when rolling over a tsdb data stream. The `index.look_ahead_time` setting default to 2 hours, which means the by default the `index.time_series_end_time` index setting of the new backing index will be 2 hours later than the `index.time_series.start_time` index setting. The the `index.time_series.start_time` and `index.time_series_end_time` index settings  control what `@timestamp` are allowed to be indexed.

Additionally the `index.look_ahead_time` setting is used to generate the `index.time_series.start_time` and `index.time_series_end_time` index settings when creating a new data stream for the first backing index. Based on the defaults of `index.look_ahead_time` setting, the  `index.time_series.start_time` index is set to current time - 2 hours and the `index.time_series_end_time` index setting is set to current time + 2 hours.

However for indexing the initial data setting the `index.time_series.start_time` index setting to 2 hours in the past sometimes creates too small time window. For example because data gets indexed starting from midnight that day. 

The idea is to add a `index.look_back_time` setting that controls how to generate the `index.time_series.start_time` index setting when creating the data stream (for the first backing index). This allows for creating a first backing index that accepts data that is earlier then current time - $index.look_ahead_time, without affecting how `index.time_series.start_time` and `index.time_series_end_time` index settings are generated during rollover.

I think a good default for the `index.look_back_time` setting would be 24 hours. Meaning that by default the `index.time_series.start_time` index setting for the first backing index of a new data stream would be current time - 24 hours.

Relates to elastic/integrations#7345
modules/data-streams/src/main/java/org/elasticsearch/datastreams/DataStreamIndexSettingsProvider.java
assert start.isBefore(end) : "data stream backing index's start time is not before end time";
                    builder.put(IndexSettings.TIME_SERIES_START_TIME.getKey(), FORMATTER.format(start));
                    builder.put(IndexSettings.TIME_SERIES_END_TIME.getKey(), FORMATTER.format(end));
                    if (allSettings.hasValue(IndexMetadata.INDEX_ROUTING_PATH.getKey()) == false
                        && combinedTemplateMappings.isEmpty() == false) {
                        List<String> routingPaths = findRoutingPaths(indexName, allSettings, combinedTemplateMappings);
                        if (routingPaths.isEmpty() == false) {
                            builder.putList(INDEX_ROUTING_PATH.getKey(), routingPaths);
                        }
                    }
                    return builder.build();
                }
            }
        }
        return Settings.EMPTY;
    }
    /**
     * Find fields in mapping that are of type keyword and time_series_dimension enabled.
     * Using MapperService here has an overhead, but allows the mappings from template to
     * be merged correctly and fetching the fields without manually parsing the mappings.
     *
     * Alternatively this method can instead parse mappings into map of maps and merge that and
     * iterate over all values to find the field that can serve as routing value. But this requires
     * mapping specific logic to exist here.
     */
    private List<String> findRoutingPaths(String indexName, Settings allSettings, List<CompressedXContent> combinedTemplateMappings) {
        var tmpIndexMetadata = IndexMetadata.builder(indexName);
        int dummyPartitionSize = IndexMetadata.INDEX_ROUTING_PARTITION_SIZE_SETTING.get(allSettings);
        int dummyShards = allSettings.getAsInt(
            IndexMetadata.SETTING_NUMBER_OF_SHARDS,