Hi @MarcusCaepio,
I'm sorry, I misread your original post - this will indeed only work if the fields are in the same document.
This kind of querying is very hard to do with Elasticsearch in general. A way that often works is to basically do the join at ingest time, meaning when ingesting the data you look up the values you are going to filter by and ingest them together with the rest of the document. Unfortunately that requires a bit more setup than just running filebeat, most likely you need a custom shipper that handles this. See also these resources: https://www.elastic.co/blog/managing-relations-inside-elasticsearch Does document database means denormalize
I'm sorry I don't have a better answer for you here.