Best practice to do customized mapping in Elasticsearch aggregation

Question

I want to carry out a customized aggregation through mapping a certain field in ES doc.

I try to leverage terms aggregation script. There're hundreds of mappings so that I have to put all of them into a HashMap:

GET /myindex/_search
{
    "query": {
        "match_all": {}
    },
    "aggs": {
        "myagg": {
            "terms": {
                "script": {
                    "source": "Map m = new HashMap(); m.put('a', 'A'); m.put('b', 'A'); m.put('bb', 'CC'); ... return m.get(doc['foo.keyword'].value)",
                    "lang": "painless"
                }
            }
        }
    },
    "size": 0
}

It's ugly and the performance is so bad even though I use the stored script. Have no idea why executing costs so much time in my script.

I also tried scripted metric aggregation. It's better but still slow compared with normal terms aggregation.

Is there any way to accelerate the mapping? (except runtime fields as My ES version does not support it)

Answer 1

tldr you could try runtime fields if you had them, but chances are they will also not be fast. that's the unfortunate nature of scripting in Elasticsearch at this point

your best bet would be what ExplodZe says above, and do that work prior during the ingestion process, to make query time faster