Optimize slow aggregation

[ebuildy (Thomas Decaux)]

I am running an index with 800.000 documents, 500Mo total, with 30 fields, small strings.

Running some aggregations takes 150ms on my Docker4Mac machine (4Go, 4 CPU i7), but more than 400ms on server (8 Go, 2 CPU Xeon E5v3 but virtualized).

I tried different elasticsearch version, tried to mount data in tmpfs etc... but dont find the bottleneck

Here my template:

PUT /_template/template_etl
{
   "template": "etl-*",
   "settings": {
      "index.mapping.ignore_malformed": true,
      "index.translog.flush_threshold_size": "1g",
      "index.translog.durability": "async",
      "number_of_replicas": "0",
      "number_of_shards": "3",
      "refresh_interval": "30s"
   },
   "mappings": {
      "_default_": {
         "dynamic_templates": [
            {
               "all_numeric": {
                  "match_mapping_type": "long",
                  "unmatch": "*_long",
                  "mapping": {
                     "type": "integer"
                  }
               }
            },
            {
               "all_string": {
                  "match": "*",
                  "match_mapping_type": "string",
                  "mapping": {
                     "type": "string",
                     "index": "not_analyzed",
                     "norms": {
                        "enabled": false
                     }
                  }
               }
            }
         ]
      }
   }
}

I try to understand a such difference, and what can I do to improve it (more CPU ? What tuning since I have only 500Mo, it should fit in page cache isnit?)

Here hot threads dump: https://gist.github.com/ebuildy/b758341b89bcf50eff454d6fc8179e76

Thanks you for some clues