Find data in 2 fields

well you can obviously do SMTP.FUIDS:<id> OR EVENT.FUID:<id> to see all the docs with a specific ID, but it sounds like you want to see all of the search results, grouped by ID, is that right?

Would it be sufficient to sort the search results by ID so that all docs for a given ID are displayed next to each other?

If you want to combine all of the docs matching a given ID into a single search result hit, that's not something you can do post indexing. You'd need to denormalize the data before sending it to ES.

In the future it might also be possible to return search results grouped by a field by using the top_hits metric in combination with the terms agg.

Sorry if I'm still not understanding your use case exactly, let me know if I'm off the mark.