[{"_id":1,"ip":"1.2.3.4","top_ports":[{"addr":"12.168.16.253","state":{"state":"up"}},{"addr":"12.168.16.252","state":{"state":"up"}},{"addr":"12.168.16.251","state":{"state":"down"}}]}]

db.collection.aggregate([{"$addFields":{"top_ports":{"$filter":{"input":"$top_ports","as":"tp","cond":{$and:[{"$eq":["$$tp.state.state","up"]},{"$eq":["$$tp.addr","12.168.16.253"]}]}}}}}])