Restrict aggregation to results of filter
Have you tried using filtered query?
{ "query": { "filtered": { "query": { "match_all": {} }, "filter": { "term": { "field1": "value" } } } }, "aggregations": { "field2": { "terms": { "field": "field2" } } }}
There is a comparison here:https://www.elastic.co/guide/en/elasticsearch/guide/current/_post_filter.html
In short, your top-level filter is acting like a post_filter in the link. To filter, then compute the aggregate, you need to use a query.
If you are concerned about the performance hit because of the computation of scores in queries, you can look into constant score queries which basically a filter-wrapper query.