Dynamic scripting (i.e. inline and indexed scripts) are disabled by default for security reasons. To enable them for just groovy scripts in aggregations you can added the following line the elasticsearch.yml file on each node:
script.engine.groovy.inline.aggs: on
More information on dynamic scripting and why it's disabled by default can be found here:
https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting.html#modules-scripting
hope that helps