How about doing that logic at index time? Make a new field, then copy into it with that logic using an update request processor.

wunder
Walter Underwood
[EMAIL PROTECTED]
http://observer.wunderwood.org/  (my blog)
NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB