Hello, what is best way to merge information from two events to a new one.

I have one evenet with connectioninformation and a second event with the userid. And I need the user ID addtionalt to the first event with the connection information forwarded in a syslog stream. There is a connectio ID in the event that I can use as filter.

Problem is, that there are some more events too with the same connection ID.