Any way to do something similar to SQL's "IN"/"NOT IN" other table?

data is something like {"log_id":"00001","return_data":"sample_data","email":"example@123","passwword":"hash","access_key":"0001","time":"2019-12-01T13:10:12.100"}
i have a list of sample access key like this
{"0002"."0001","1","0","2516"}
i want to visualize is there any key not being in use in a time frame.
im off work now so the data is not that accurate, but the important part is there. thank you for the attention, i have been trying to do this for a few day now, kinda frustrating, i know i can do it on the mysql server, but we want all the data presented at the same place, maybe i should do it before logstash?