您可以使用bucket选择器聚合来过滤bucket
bucket selector aggregation是一个父管道聚合，它执行一个脚本，该脚本确定当前bucket是否将保留在父多bucket聚合中。

{
  "size": "0",
  "query": {
    "range": {
      "@timestamp": {
        "gte": "2020-10-20T00:00:00",
        "lt": "2020-10-21T00:00:00"
      }
    }
  },
  "aggs": {
    "ids": {
      "terms": {
        "field": "Id.keyword",
        "size": 1000
      },
      "aggs": {
        "count_filter": {
          "bucket_selector": {
            "buckets_path": {
              "values": "_count"
            },
            "script": "params.values < 2000"   <-- note this
          }
        }
      }
    }
  }
}