{
"query": {
"bool": {
"must_not": [ // exclude those parents, which ...
{
"nested": {
"path": "SecurityCodes",
"query": {
"bool": {
"must": [ // .. has any child ...
"exists": {
"field": "SecurityCodes.Name"
}
],
"must_not": [ // ... but not Restricted
{
"match": {
"SecurityCodes.Name": {
"query": "Restricted"
}
}
}
],
}
}
]
}
}
}
Assuming that ES handles top pure negation query, it might do the thing.