[{/**"_id" : ObjectId("..."),*/"ip_str":"52.217.105.116","data":[{"ssl":{"cert":{"expired":"False"}}}]}]

db.collection.aggregate([{$match:{"ip_str":{$in:["52.217.105.116"]}}},{$project:{ip_str:1,expired:{$arrayElemAt:["$data.ssl.cert.expired",0]}}}])