Logstash Aggregation

You should re-read the link I sent you. The Reindex API, while it can "dump" an index into a new one, it's much more sophisticated than just that use case. It also allows you to use the results of a query to populate a new index:

POST _reindex
{
  "source": {
    "index": "twitter",
    "type": "tweet",
    "query": {
      "term": {
        "user": "kimchy"
      }
    }
  },
  "dest": {
    "index": "new_twitter"
  }
}

So, why not try aggregations in a reindex with a query?