Uses the same canonical field/op/values filter dialect as traces, logs, and unified telemetry queries.