I am running the following aggregation query and it is returning the expected results. However, it is also returning a bunch of non-desired facets. This is because there can be one or more org objects per document (with at least one matching the query syntax of course) and they were NOT indexed as nested objects so all org.normalized values for a matching document get counted as part of the aggregation. My question is, can I do some post/sub-query type of thing and/or a sub-aggregation to get the desired results (all org.normalized value ending with a &)? Any help that anyone may be able to provide would be appreciated. Thanks.
Kevin
{ "size": 0, "aggs" : { "names" : { "filter" : { "regexp": { "orgs.normalized": ".*[&]" } }, "aggs" : { "filteredNames" : { "terms": {"field" : "orgs.normalized", "size": 100} } } } } }