aggregation having should filter groups by count thresholds