# Script aggreation shows significant performance issue then none-script aggreation **URL:** \ **Category:** Elasticsearch\ **Created:** [June 27, 2016, 7:10am UTC](https://discuss.elastic.co/t/script-aggreation-shows-significant-performance-issue-then-none-script-aggreation/54000 "2016-06-27T07:10:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Jin\_Guo](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Jin\_Guo](https://discuss.elastic.co/u/Jin_Guo)\ **Post date:** [June 27, 2016, 7:10am UTC](https://discuss.elastic.co/t/script-aggreation-shows-significant-performance-issue-then-none-script-aggreation/54000/1 "2016-06-27T07:10:17Z")
Hi All, I currently meet siginificant performance issue when using script aggreation. Here is my test script which using to do some mapping work: ``` GET _search { "size": 0, "aggs": { "id_host_status": { "terms": { "size": 0, "script": "if (doc['HOST_STATUS'].value == 'Closed_Adm' || doc['HOST_STATUS'].value == 'Closed_Full' || doc['HOST_STATUS'].value == 'Closed_LIM' ) { return 'Close'} else if(doc['HOST_STATUS'].value == 'Unavailable' || doc['HOST_STATUS'].value == 'Unavail'){return 'Unavail'} else { return doc['HOST_STATUS'].value} " } } } } ``` It took **17+ seconds** to go through around 9M records ``` { "took": 17608, "timed_out": false, "_shards": { "total": 2, "successful": 2, "failed": 0 }, "hits": { "total": 8834017, "max_score": 0, "hits": [] }, "aggregations": { "id_host_status": { "doc_count_error_upper_bound": 0, "sum_other_doc_count": 0, "buckets": [ { "key": "OK", "doc_count": 8299098 }, { "key": "Unavail", "doc_count": 381977 }, { "key": "busy", "doc_count": 150535 }, { "key": "-OK", "doc_count": 2403 }, { "key": "-busy", "doc_count": 4 } ] } } } ``` which was much slowers then using simply terms aggreation ( **400+ ms** in below case): ``` GET _search { "size": 0, "aggs": { "id_host_status": { "terms": { "field": "HOST_STATUS" } } } } ``` Did I using a wrong way? or any other better way avaliable? Many thanks. Jin ---
**Author:** ![JoarSvensson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joarsvensson/32/8740_2.png) [@JoarSvensson](https://discuss.elastic.co/u/JoarSvensson)\ **Post date:** [June 27, 2016, 9:57am UTC](https://discuss.elastic.co/t/script-aggreation-shows-significant-performance-issue-then-none-script-aggreation/54000/2 "2016-06-27T09:57:08Z")
Performance wise it's indeed slower to use scripting in most cases. If this is a common aggregation you perform, I would suggest you alter the values in the pipline (Logstash) prior to indexing the documents. In other words, move that logic prior indexing instead (if possible), it will speed up aggregations significantly. ---
**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\ **Post date:** [June 27, 2016, 10:21am UTC](https://discuss.elastic.co/t/script-aggreation-shows-significant-performance-issue-then-none-script-aggreation/54000/3 "2016-06-27T10:21:03Z")
One way without using scripts is as follows: ``` GET lastfmusers2/_search { "size": 0, "aggs": { "GroupedTerms": { "filters": { "filters": { "Europe": { "terms": { "country.raw": [ "France", "Germany", "Spain", ... ] } }, "Asia": { "terms": { "country.raw": [ "China", "Japan", "India", ... ] } } } } }, "OtherUngroupedTerms": { "terms": { "field": "country.raw", "exclude": [ "France", "Germany", "Spain", ... "China", "Japan", "India", ... ] } } } } ``` ---
**Author:** ![Jin\_Guo](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Jin\_Guo](https://discuss.elastic.co/u/Jin_Guo)\ **Post date:** [June 28, 2016, 1:48am UTC](https://discuss.elastic.co/t/script-aggreation-shows-significant-performance-issue-then-none-script-aggreation/54000/4 "2016-06-28T01:48:55Z")
Joar, Thanks for your suggestion. My case is the use might be modify the mapping online, so it's hard to do the mapping thing before indexing. ☹ ---
**Author:** ![Jin\_Guo](https://avatars.discourse-cdn.com/v4/letter/j/848f3c/32.png) [@Jin\_Guo](https://discuss.elastic.co/u/Jin_Guo)\ **Post date:** [June 28, 2016, 1:55am UTC](https://discuss.elastic.co/t/script-aggreation-shows-significant-performance-issue-then-none-script-aggreation/54000/5 "2016-06-28T01:55:35Z")
Hi Mark, It looks great. Is there any possiblity to move the "OtherUngroupedTerms" into "GroupedTerms"? As I need to do other sub-aggs after "GroupedTerms". Otherwise, I need to double the logic and added it after "GroupedTerms" and "OtherUngroupedTerms" separately. Thanks, Jin ---
**Author:** ![colings86](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/colings86/32/44960_2.png) [@colings86](https://discuss.elastic.co/u/colings86)\ **Post date:** [June 28, 2016, 12:42pm UTC](https://discuss.elastic.co/t/script-aggreation-shows-significant-performance-issue-then-none-script-aggreation/54000/6 "2016-06-28T12:42:53Z")
@Jin_Guo have a look at [https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filters-aggregation.html#\_literal\_other\_literal\_bucket](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-filters-aggregation.html#_literal_other_literal_bucket) for using the `other` bucket in the filters aggregation ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:39pm UTC](https://discuss.elastic.co/t/script-aggreation-shows-significant-performance-issue-then-none-script-aggreation/54000/7 "2017-07-05T22:39:55Z")