Hard to say really, a lot has changed from 2.x to 6.x. But one major source of slow queries does come to mind.
There was a change in how numerics are stored internally, to use a new datastructure. This datastructure is superior for numeric-style queries (ranges, etc). But it is slow to do single point lookups.
People get into trouble when they have an identifier which is stored as a numeric value (12345), and then query that ID with term/terms style queries (e.g. "find me this specific ID or IDs).
If you have that situation, you should remap your IDs as keywords which are optimized for single term lookups.
I wrote some more about it here: The queries for numeric fields are slower after upgraded the cluster from 2.4.5 to 5.6.3 - #2 by polyfractal
Unsure if that's the situation you're running into, but it's a common cause of slower queries after upgrading.