[Transform] add support for script in group_by

[hendrikmuhs]

add the possibility to base the group_by on the output of a script.

closes #43152

Example usecase:

POST _transform/_preview
{
  "source": {
    "index": [
      "kibana_sample_data_logs"
    ]
  },
  "pivot": {
    "group_by": {
      "agent": {
        "terms": {
          "script": {
            "source": """String agent = doc['agent.keyword'].value; 
            if (agent.contains("MSIE")) { 
              return "internet explorer";
            } else if (agent.contains("AppleWebKit")) { 
              return "safari"; 
            } else if (agent.contains('Firefox')) { 
              return "firefox";
            } else { return agent }""",
            "lang": "painless"
          }
        }
      }
    },
    "aggregations": {
      "200": {
        "filter": {
          "term": {
            "response": "200"
          }
        }
      },
      "404": {
        "filter": {
          "term": {
            "response": "404"
          }
        }
      },
      "503": {
        "filter": {
          "term": {
            "response": "503"
          }
        }
      }
    }
  },
  "dest": {
    "index": "pivot_logs"
  }
}

outputs

{
  "preview" : [
    {
      "agent" : "firefox",
      "200" : 4931,
      "404" : 259,
      "503" : 172
    },
    {
      "agent" : "internet explorer",
      "200" : 3674,
      "404" : 210,
      "503" : 126
    },
    {
      "agent" : "safari",
      "200" : 4227,
      "404" : 332,
      "503" : 143
    }
  ],
  "mappings" : {
    "properties" : {
      "200" : {
        "type" : "long"
      },
      "agent" : {
        "type" : "keyword"
      },
      "404" : {
        "type" : "long"
      },
      "503" : {
        "type" : "long"
      }
    }
  }
}

[elasticmachine]

Pinging @elastic/ml-core (:ml/Transform)

[benwtrent]

I am guessing #53135 was discovered while developing this.

I think we should hold off on merging this until the composite agg issue is fixed yes?

[hendrikmuhs]

I am guessing #53135 was discovered while developing this.

I think we should hold off on merging this until the composite agg issue is fixed yes?

I do not think #53135 is a blocker for this PR, because it only affects a special case namely using _value in scripts which is a shortcut for doc['field_i_am_interested_in'].value. Another alternative is to use the context object. Both using doc or ctx seem to be more common than _value.

It would of course be great to fix #53135 before 7.7.0, still I see no justification for a blocker.

[benwtrent]

@hendrikmuhs I misunderstood the issue then. I did not know it was only for the _value case.