[{"id":"SOMEID","03":{"17":{"id":"xxx","name":"test","lastSeen":"2025-03-17","someotherkey":"value"},"18":{"id":"xxx","name":"myname","lastSeen":"2025-03-18","someotherkey":"value"}}},{"id":"SOMEID","04":{"20":{"id":"xxx","name":"myname","lastSeen":"2025-04-20","someotherkey":"value"},"21":{"id":"123","dnsName":"myname","lastSeen":"2025-04-20","someotherkey":"value"}}}]

db.collection.aggregate([{$replaceWith:{_id:"$_id",doc:{/** assumes one month per doc (one top-level field)*/$first:{$filter:{input:{$objectToArray:"$$ROOT"},cond:{/** skip _id since it's separate*/$ne:["$$this.k","_id"]}}}}}},{/** the input $doc can be combined* with the stage above*/$set:{doc:{v:{$objectToArray:"$doc.v"}}}},{$match:{$or:[{"doc.v.v.name":{$regex:"vmWBPrd01VANZEAL"}},{"doc.v.v.ip":"vmWBPrd01VANZEAL"}]/** SEARCH TERM HERE*/}},{/** undo the transformations*/$set:{doc:[{k:"$doc.k",v:{$arrayToObject:"$doc.v"}}]}},{$replaceWith:{$mergeObjects:[{_id:"$_id"},{$arrayToObject:"$doc"}]}}])