Join data cross two index based on common field

Hi Team,

In my local elk stack, below two index are created.

  1. kvaudit*
    • This one is index customer behavior data. Example data:

module=SCM fa=TS at=SCM.TS.MODIFY_SEARCH ci=SCMStella cn=SCMStella cs=qacandrot_SCMStella. pi=dbPool1 ui=cgrant1 locale=en_US ktf1=[C,E,X,H,M]


  1. testcase*
    • This one is index test case. Example data:
      caseid, classname,features,at,author,module


There is a common fields call 'at' in both index.

My requirement is to join the data of these 2 index based on at field to setup the connection between customer behavior data and test case, then view in kibana.

Is it achievable and any solution?

See here for creating a third index from the union of two existing indices.