在filter的基础上对cpe_info.cve_id进行terms聚合。

{
    "size": 0,
    "aggs": {
        "answers": {
            "nested": {
                "path": "cpe_info"
            },
            "aggs": {
                "severity_filter": {
                    "filter": {
                        "terms": {
                            "cpe_info.severity": ["高危", "超危"]
                        }
                    },
                    "aggs": {
                        "cve_id": {
                            "terms": {
                                "field": "cpe_info.cve_id",
                                "size": 20,
                                "order": {
                                    "_count": "desc"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}