How can I aggregate filtered nested documents in ElasticSearch?

Question

Suppose I have an index with nested document that looks like this:

{
    "id" : 1234
    "cars" : [{
            "id" : 987
            "name" : "Volkswagen"
        }, {
            "id": 988
            "name" : "Tesla"
        }
    ]
}

I now want to get a count aggregation of "car" documents that match a certain criteria, e.g. that match a search query. My initial attempt was the following query:

{
  "query" : {
    "nested" : {
      "path" : "cars",
      "query" : {
        "query_string" : {
          "fields" : ["cars.name"],
          "query" : "Tes*"
        }
      }
    }
  },
  "aggregations" : {
    "cars" :{
      "nested" : {
        "path" : "cars"
      },
      "aggs" : {
        "cars" : {
          "terms" : {
            "field" : "cars.id"
          }
        }
      }
    }
  }
}

I was hoping here to get an aggregation result with only the ids of cars whose name begin with "Tes". However, the aggregation instead uses all cars that are in a top-level document that also contains a matching nested documents. That is, in the above example "Volkswagen" would also be counted because the top-level document also contains a car that does match.

How can I get an aggregation of just the matching nested documents?

Answer 1

In the mean time I've figured it out: to achieve this a filter aggregation should be added around the the terms aggregation like so:

  "aggregations" : {
    "cars" :{
      "nested" : {
        "path" : "cars"
      },
      "aggs" : {
        "cars-filter" : {
          "filter" : {
            "query" : {
              "query_string" : {
                "fields" : ["cars.name"],
                "query" : "Tes*"
              }
            }  
          },
          "aggs" : {
            "cars" : {
              "terms" : {
                "field" : "cars.id"
              }
            }
          }
        }
      }
    }
  }