Join data cross two index based on common field

Hi Team,

In my local elk stack, below two index are created.

  1. kvaudit*
    • This one is index customer behavior data. Example data:
      `

module=SCM fa=TS at=SCM.TS.MODIFY_SEARCH si=4C3D8709E51DDC4EE879A9E30729B512.mo-5692ea7ca ci=SCMStella cn=SCMStella cs=qacandrot_SCMStella. pi=dbPool1 ui=cgrant1 locale=en_US ktf1=[C,E,X,H,M]

`

  1. testcase*
    • This one is index test case. Example data:
      caseid, classname,features,at,author,module

ENT200021808,Verifythatmodifysearchbuttonworksasexpected,TS,SCM.TS.MODIFY_SEARCH,I348636,SCM

There is a common fields call 'at' in both index.

My requirement is to join the data of these 2 index based on at field to setup the connection between customer behavior data and test case, then view in kibana.

Is it achievable and any solution?

See here for creating a third index from the union of two existing indices.