Aggregation return data that do not match query

Elastic Stack Elasticsearch
3

This solve my issue (include part):

POST _search
{
   "aggs":{
      "termBucketAgg":{
         "terms":{
            "field":"categories.keyword",
            "shard_size":65,
            "size":10,
            "include": ".*[cC][oO][nN].*"
         }
      }
   },
   "query":{
      "bool":{
         "must":[
            {
               "query_string":{
                  "fields":[
                     "categories"
                  ],
                  "query":"*con*"
               }
            }
         ]
      }
   },
   "size":0
}