Fix the log filtering examples so they work without a message-parsing pipeline #9185

Problem

The log filtering page uses one bulk request to add example logs, and its KQL, Query DSL, and aggregation sections all depend on that data. On a fresh Observability serverless project, the example documents have only a message field. That causes two failures:

• No log.level field. ERROR and WARN appear only as text inside message. The KQL query log.level: ("ERROR" or "WARN") and the equivalent ES|QL query find no field to filter on. ES|QL returns Unknown column [log.level].
• @timestamp is the ingest time. The timestamps in message (April 2025) aren't the document timestamp, so the absolute time range from Apr 14 to Apr 15, 2025 matches nothing.

The page might work on projects where a processing pipeline parses message. That isn't confirmed.

Page

solutions/observability/logs/filter-aggregate-logs.md

Possible fix

Add @timestamp and log.level to each example document in the three bulk requests, so the examples work whatever the project's pipelines do. Then check the queries, the example output, and the screenshots in all three sections.

Context

Found while testing PR #9017, which adds ES|QL and classic mode alternatives to pages that assumed a data view. The log filtering page keeps a note to switch to classic mode, because its steps need this fix first.