title: Elasticsearch: How do I exclude counting some of the fields while keeping the log from being filtered out?
body: <p>I hope the question is not very vague....</p>
  
  <p>I have bunch of logs in ES, and I'm trying to aggregate the sum of a specific field, in this case, <code>file</code>, the mapping is</p>
  
  <p><code>http://localhost:9200/set_1/record/_mapping</code></p>
  
  <pre><code>"properties": {
      "tags": {"type":"object","dynamic":false,"properties":{
                  "all":{"type":"string","analyzer":"my_analyzer","store":"true"},
                  "some_other_stuff_that's_not_important":.....
      },
      "file": {"type":"nested","dynamic":"false","include_in_root":"true","properties":{
                  "doctype":{"type":"string","index":"not_analyzed","include_in_all":"false"},
                  "some_other_stuff": {....}
      }
  </code></pre>
  
  <p>so right now I want to filter everything with a <code>tag</code> called <code>download</code>, and I want to count the number of <code>file</code> in those filtered logs</p>
  
  <pre><code>{
    "query": {
      "bool": {
        "must": [
          {
            "term": {
              "tags.all": "Downloaded"
            }
          }
        ]
      }
    }
  }
  </code></pre>
  
  <p>Now, the <code>file</code> will be a list of different files included in this log, and I want to know how to aggregate if I want to count all of the files but excluding certain file type like, say, <code>.docx</code></p>
  
  <p>How should I form the aggregation query?</p>