How about doing that logic at index time? Make a new field, then copy into it with that logic using an update request processor.

Walter Underwood
[EMAIL PROTECTED]  (my blog)
NEW: Monitor These Apps!
elasticsearch, apache solr, apache hbase, hadoop, redis, casssandra, amazon cloudwatch, mysql, memcached, apache kafka, apache zookeeper, apache storm, ubuntu, centOS, red hat, debian, puppet labs, java, senseiDB