query to show sub aggregation filtered by query