Many thanks - I will investigate maintaining a set of purpose-defined indexes to do this with an application-side JOIN
I suspect that even though this does seem tedious (if compared to a more simple SQL approach) we believe that overall ELK will offer us huge benefits, so paying a small "complexity price" for a couple of use cases (out of many) is not a show-stopper