Aggregation only over the search results

[namespace-Pt (pt)]

I found that the terms aggregations always inspect the entire collection, for example I use

{
    "query": {
        "match": {
            "text field": "some text"
        }
    },
    "aggs": {
        "agg-terms": {
            "terms": {
                "field": "my term field"
            }
        }
    }
  },

The system returns total=10000 while the document count in each bucket is about 200k (significantly greater than the total results). Can I limit the aggregations to only perform over returned results?

[Mark_Harwood1 (Mark Harwood)]

Aggregations do run across search results only.

@namespace-Pt

The system returns total=10000

10k is the max number of hits counted when track_total_hits is set to false (the default) and the figure is not accurate but “greater than equal”.