HOW-TO: negate an aggregation

hi guys,

could you please advise on how to negate an aggregation ?
for example, how can i find the documents that the next_hop does not belong to the IP v4 range aggregation ?

Nikos