diff --git a/Cargo.lock b/Cargo.lock
index 1bd332540f4a6..6d25c4b53e206 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -464,7 +464,7 @@ dependencies = [
  "fnv",
  "futures-util",
  "http 1.1.0",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "mime",
  "multer",
  "num-traits",
@@ -514,7 +514,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69117c43c01d81a69890a9f5dd6235f2f027ca8d1ec62d6d3c5e01ca0edb4f2b"
 dependencies = [
  "bytes 1.7.1",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "serde",
  "serde_json",
 ]
@@ -3429,7 +3429,7 @@ dependencies = [
  "flate2",
  "futures 0.3.30",
  "glob",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "libc",
  "quickcheck",
  "scan_fmt",
@@ -3909,7 +3909,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "http 0.2.9",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -3928,7 +3928,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http 1.1.0",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -4617,9 +4617,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.2.6"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
+checksum = "93ead53efc7ea8ed3cfb0c79fc8023fbb782a5432b52830b6518941cebe6505c"
 dependencies = [
  "equivalent",
  "hashbrown 0.14.5",
@@ -5086,7 +5086,7 @@ dependencies = [
  "ena",
  "is-terminal",
  "itertools 0.10.5",
- "lalrpop-util",
+ "lalrpop-util 0.20.0",
  "petgraph",
  "regex",
  "regex-syntax 0.7.5",
@@ -5102,6 +5102,15 @@ version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f35c735096c0293d313e8f2a641627472b83d01b937177fe76e5e2708d31e0d"
 
+[[package]]
+name = "lalrpop-util"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "108dc8f5dabad92c65a03523055577d847f5dcc00f3e7d3a68bc4d48e01d8fe1"
+dependencies = [
+ "regex-automata 0.4.4",
+]
+
 [[package]]
 name = "lapin"
 version = "2.5.0"
@@ -5457,7 +5466,7 @@ version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fb791d015f8947acf5a7f62bd28d00f289bb7ea98cfbe3ffec1d061eee12df12"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "itoa",
  "lockfree-object-pool",
  "metrics",
@@ -5478,7 +5487,7 @@ dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
  "hashbrown 0.14.5",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "metrics",
  "num_cpus",
  "ordered-float 4.2.2",
@@ -6598,7 +6607,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
 dependencies = [
  "fixedbitset",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
 ]
 
 [[package]]
@@ -7056,7 +7065,7 @@ dependencies = [
 name = "prometheus-parser"
 version = "0.1.0"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "nom",
  "num_enum 0.7.3",
  "prost 0.12.6",
@@ -7117,6 +7126,16 @@ dependencies = [
  "prost-derive 0.12.6",
 ]
 
+[[package]]
+name = "prost"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13db3d3fde688c61e2446b4d843bc27a7e8af269a69440c0308021dc92333cc"
+dependencies = [
+ "bytes 1.7.1",
+ "prost-derive 0.13.1",
+]
+
 [[package]]
 name = "prost-build"
 version = "0.11.9"
@@ -7187,15 +7206,28 @@ dependencies = [
 ]
 
 [[package]]
-name = "prost-reflect"
+name = "prost-derive"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f5eec97d5d34bdd17ad2db2219aabf46b054c6c41bd5529767c9ce55be5898f"
+checksum = "18bec9b0adc4eba778b33684b7ba3e7137789434769ee3ce3930463ef904cfca"
+dependencies = [
+ "anyhow",
+ "itertools 0.13.0",
+ "proc-macro2 1.0.86",
+ "quote 1.0.37",
+ "syn 2.0.75",
+]
+
+[[package]]
+name = "prost-reflect"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55a6a9143ae25c25fa7b6a48d6cc08b10785372060009c25140a4e7c340e95af"
 dependencies = [
  "base64 0.22.1",
  "once_cell",
- "prost 0.12.6",
- "prost-types 0.12.6",
+ "prost 0.13.1",
+ "prost-types 0.13.1",
  "serde",
  "serde-value",
 ]
@@ -7218,6 +7250,15 @@ dependencies = [
  "prost 0.12.6",
 ]
 
+[[package]]
+name = "prost-types"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cee5168b05f49d4b0ca581206eb14a7b22fafd963efe729ac48eb03266e25cc2"
+dependencies = [
+ "prost 0.13.1",
+]
+
 [[package]]
 name = "psl"
 version = "2.1.22"
@@ -8456,7 +8497,7 @@ version = "1.0.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "83c8e735a073ccf5be70aa8066aa984eaf2fa000db6c8d0100ae605b366d31ed"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "itoa",
  "memchr",
  "ryu",
@@ -8554,7 +8595,7 @@ dependencies = [
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "serde",
  "serde_derive",
  "serde_json",
@@ -8604,7 +8645,7 @@ version = "0.9.34+deprecated"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "itoa",
  "ryu",
  "serde",
@@ -9591,7 +9632,7 @@ version = "0.19.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "toml_datetime",
  "winnow 0.5.18",
 ]
@@ -9602,7 +9643,7 @@ version = "0.20.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70f427fce4d84c72b5b732388bf4a9f4531b53f74e2887e3ecb2481f68f66d81"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "toml_datetime",
  "winnow 0.5.18",
 ]
@@ -9613,7 +9654,7 @@ version = "0.21.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8534fd7f78b5405e860340ad6575217ce99f38d4d5c8f2442cb5ecb50090e1"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "toml_datetime",
  "winnow 0.5.18",
 ]
@@ -9624,7 +9665,7 @@ version = "0.22.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "583c44c02ad26b0c3f3066fe629275e50627026c51ac2e595cca4c230ce1ce1d"
 dependencies = [
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -10297,7 +10338,7 @@ dependencies = [
  "dunce",
  "glob",
  "hex",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "indicatif",
  "itertools 0.13.0",
  "log",
@@ -10399,7 +10440,7 @@ dependencies = [
  "hyper 0.14.28",
  "hyper-openssl",
  "hyper-proxy",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "indoc",
  "infer 0.16.0",
  "inventory",
@@ -10584,7 +10625,7 @@ dependencies = [
  "crossbeam-utils",
  "derivative",
  "futures 0.3.30",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "metrics",
  "nom",
  "ordered-float 4.2.2",
@@ -10615,7 +10656,7 @@ dependencies = [
  "chrono-tz",
  "encoding_rs",
  "http 0.2.9",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "inventory",
  "no-proxy",
  "num-traits",
@@ -10685,7 +10726,7 @@ dependencies = [
  "headers",
  "http 0.2.9",
  "hyper-proxy",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "ipnet",
  "metrics",
  "metrics-tracing-context",
@@ -10879,8 +10920,7 @@ checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
 [[package]]
 name = "vrl"
 version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84451e6a979d54175932cfe49f36f31ab7a483f3feb3cfa65ee584b91ef2f858"
+source = "git+https://github.com/vectordotdev/vrl?rev=bab1cd50658f8a50008902e96e9fa4e5c5a9547c#bab1cd50658f8a50008902e96e9fa4e5c5a9547c"
 dependencies = [
  "aes",
  "ansi_term",
@@ -10900,6 +10940,7 @@ dependencies = [
  "clap",
  "codespan-reporting",
  "community-id",
+ "convert_case 0.6.0",
  "crypto_secretbox",
  "csv",
  "ctr",
@@ -10916,11 +10957,12 @@ dependencies = [
  "hostname 0.4.0",
  "iana-time-zone",
  "idna 0.5.0",
- "indexmap 2.2.6",
+ "indexmap 2.4.0",
  "indoc",
+ "influxdb-line-protocol",
  "itertools 0.13.0",
  "lalrpop",
- "lalrpop-util",
+ "lalrpop-util 0.21.0",
  "md-5",
  "mlua",
  "nom",
@@ -10935,7 +10977,7 @@ dependencies = [
  "pest_derive",
  "prettydiff",
  "prettytable-rs",
- "prost 0.12.6",
+ "prost 0.13.1",
  "prost-reflect",
  "psl",
  "psl-types",
diff --git a/Cargo.toml b/Cargo.toml
index c6da73a9193a5..7b8d80aedf6ce 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -132,19 +132,20 @@ members = [
 [workspace.dependencies]
 chrono = { version = "0.4.38", default-features = false, features = ["clock", "serde"] }
 clap = { version = "4.5.16", default-features = false, features = ["derive", "error-context", "env", "help", "std", "string", "usage", "wrap_help"] }
-indexmap = { version = "2.2.6", default-features = false, features = ["serde", "std"] }
+indexmap = { version = "2.4.0", default-features = false, features = ["serde", "std"] }
 metrics = "0.22.3"
 metrics-tracing-context = { version = "0.15.0", default-features = false }
 metrics-util = { version = "0.16.3", default-features = false, features = ["registry"] }
 pin-project = { version = "1.1.5", default-features = false }
 proptest = { version = "1.5" }
 proptest-derive = { version = "0.4.0" }
+prost-reflect = { version = "0.14", default-features = false }
 serde_json = { version = "1.0.125", default-features = false, features = ["raw_value", "std"] }
 serde = { version = "1.0.209", default-features = false, features = ["alloc", "derive", "rc"] }
 toml = { version = "0.8.19", default-features = false, features = ["display", "parse"] }
 tonic = { version = "0.11", default-features = false, features = ["transport", "codegen", "prost", "tls", "tls-roots", "gzip"] }
 tonic-build = { version = "0.11", default-features = false, features = ["transport", "prost"] }
-vrl = { version = "0.17.0", features = ["arbitrary", "cli", "test", "test_framework"] }
+vrl = { git = "https://github.com/vectordotdev/vrl", rev = "bab1cd50658f8a50008902e96e9fa4e5c5a9547c", features = ["arbitrary", "cli", "test", "test_framework"] }
 
 [dependencies]
 pin-project.workspace = true
@@ -233,7 +234,7 @@ rmpv = { version = "1.3.0", default-features = false, features = ["with-serde"],
 
 # Prost / Protocol Buffers
 prost = { version = "0.12", default-features = false, features = ["std"] }
-prost-reflect = { version = "0.13", default-features = false, optional = true }
+prost-reflect = { workspace = true, optional = true }
 prost-types = { version = "0.12", default-features = false, optional = true }
 
 # GCP
diff --git a/lib/codecs/Cargo.toml b/lib/codecs/Cargo.toml
index 77516631d05b2..b7851992ccdcf 100644
--- a/lib/codecs/Cargo.toml
+++ b/lib/codecs/Cargo.toml
@@ -22,7 +22,7 @@ memchr = { version = "2", default-features = false }
 once_cell = { version = "1.19", default-features = false }
 ordered-float = { version = "4.2.2", default-features = false }
 prost = { version = "0.12.6", default-features = false, features = ["std"] }
-prost-reflect = { version = "0.13", default-features = false, features = ["serde"] }
+prost-reflect = { workspace = true, features = ["serde"] }
 regex = { version = "1.10.6", default-features = false, features = ["std", "perf"] }
 serde.workspace = true
 serde_json.workspace = true
diff --git a/lib/codecs/src/encoding/format/protobuf.rs b/lib/codecs/src/encoding/format/protobuf.rs
index 1313124d0bcb7..1835540eaef20 100644
--- a/lib/codecs/src/encoding/format/protobuf.rs
+++ b/lib/codecs/src/encoding/format/protobuf.rs
@@ -1,7 +1,6 @@
 use crate::encoding::BuildError;
 use bytes::BytesMut;
-use prost::Message;
-use prost_reflect::MessageDescriptor;
+use prost_reflect::{prost::Message as _, MessageDescriptor};
 use std::path::PathBuf;
 use tokio_util::codec::Encoder;
 use vector_core::{
diff --git a/src/conditions/datadog_search.rs b/src/conditions/datadog_search.rs
index d192f9b910436..4bccb02a3ade5 100644
--- a/src/conditions/datadog_search.rs
+++ b/src/conditions/datadog_search.rs
@@ -8,8 +8,7 @@ use vrl::datadog_filter::{
     regex::{wildcard_regex, word_regex},
     Filter, Matcher, Resolver, Run,
 };
-use vrl::datadog_search_syntax::parse;
-use vrl::datadog_search_syntax::{Comparison, ComparisonValue, Field};
+use vrl::datadog_search_syntax::{Comparison, ComparisonValue, Field, QueryNode};
 
 use crate::conditions::{Condition, Conditional, ConditionalConfig};
 
@@ -42,7 +41,7 @@ impl ConditionalConfig for DatadogSearchConfig {
         &self,
         _enrichment_tables: &vector_lib::enrichment::TableRegistry,
     ) -> crate::Result<Condition> {
-        let node = parse(&self.source)?;
+        let node: QueryNode = self.source.parse()?;
         let matcher = as_log(build_matcher(&node, &EventFilter));
 
         Ok(Condition::DatadogSearch(DatadogSearchRunner { matcher }))
@@ -77,7 +76,7 @@ impl Filter<LogEvent> for EventFilter {
             Field::Reserved(field) if field == "tags" => {
                 any_string_match("tags", move |value| value == field)
             }
-            Field::Default(f) | Field::Facet(f) | Field::Reserved(f) => {
+            Field::Default(f) | Field::Attribute(f) | Field::Reserved(f) => {
                 Run::boxed(move |log: &LogEvent| {
                     log.parse_path_and_get_value(f.as_str())
                         .ok()
@@ -111,7 +110,7 @@ impl Filter<LogEvent> for EventFilter {
                 array_match("tags", move |values| values.contains(&value_bytes))
             }
             // Everything else is matched by string equality.
-            Field::Reserved(field) | Field::Facet(field) => {
+            Field::Reserved(field) | Field::Attribute(field) => {
                 let to_match = to_match.to_owned();
 
                 string_match(field, move |value| value == to_match)
@@ -134,7 +133,7 @@ impl Filter<LogEvent> for EventFilter {
                 any_string_match("tags", move |value| value.starts_with(&starts_with))
             }
             // All other field types are compared by complete value.
-            Field::Reserved(field) | Field::Facet(field) => {
+            Field::Reserved(field) | Field::Attribute(field) => {
                 let prefix = prefix.to_owned();
 
                 string_match(field, move |value| value.starts_with(&prefix))
@@ -154,7 +153,7 @@ impl Filter<LogEvent> for EventFilter {
 
                 any_string_match("tags", move |value| re.is_match(&value))
             }
-            Field::Reserved(field) | Field::Facet(field) => {
+            Field::Reserved(field) | Field::Attribute(field) => {
                 let re = wildcard_regex(wildcard);
 
                 string_match(field, move |value| re.is_match(&value))
@@ -171,8 +170,8 @@ impl Filter<LogEvent> for EventFilter {
         let rhs = Cow::from(comparison_value.to_string());
 
         match field {
-            // Facets are compared numerically if the value is numeric, or as strings otherwise.
-            Field::Facet(f) => {
+            // Attributes are compared numerically if the value is numeric, or as strings otherwise.
+            Field::Attribute(f) => {
                 Run::boxed(move |log: &LogEvent| {
                     match (
                         log.parse_path_and_get_value(f.as_str()).ok().flatten(),
@@ -327,10 +326,9 @@ where
 
 #[cfg(test)]
 mod test {
-    use serde_json::json;
     use vector_lib::event::Event;
     use vrl::datadog_filter::{build_matcher, Filter, Resolver};
-    use vrl::datadog_search_syntax::parse;
+    use vrl::datadog_search_syntax::QueryNode;
 
     use super::*;
     use crate::log_event;
@@ -359,23 +357,23 @@ mod test {
                 log_event!["tags" => vec!["b:foo"]],
                 log_event!["tags" => vec!["a:foo"]],
             ),
-            // Facet exists.
+            // Attribute exists.
             (
                 "_exists_:@b",
-                log_event!["custom" => json!({"b": "foo"})],
-                log_event!["custom" => json!({"a": "foo"})],
+                log_event!["b" => "foo"],
+                log_event!["a" => "foo"],
             ),
-            // Facet exists (negate).
+            // Attribute exists (negate).
             (
                 "NOT _exists_:@b",
-                log_event!["custom" => json!({"a": "foo"})],
-                log_event!["custom" => json!({"b": "foo"})],
+                log_event!["a" => "foo"],
+                log_event!["b" => "foo"],
             ),
-            // Facet exists (negate w/-).
+            // Attribute exists (negate w/-).
             (
                 "-_exists_:@b",
-                log_event!["custom" => json!({"a": "foo"})],
-                log_event!["custom" => json!({"b": "foo"})],
+                log_event!["a" => "foo"],
+                log_event!["b" => "foo"],
             ),
             // Tag doesn't exist.
             (
@@ -395,23 +393,23 @@ mod test {
                 log_event!["tags" => vec!["a:foo"]],
                 log_event![],
             ),
-            // Facet doesn't exist.
+            // Attribute doesn't exist.
             (
                 "_missing_:@b",
-                log_event!["custom" => json!({"a": "foo"})],
-                log_event!["custom" => json!({"b": "foo"})],
+                log_event!["a" => "foo"],
+                log_event!["b" => "foo"],
             ),
-            // Facet doesn't exist (negate).
+            // Attribute doesn't exist (negate).
             (
                 "NOT _missing_:@b",
-                log_event!["custom" => json!({"b": "foo"})],
-                log_event!["custom" => json!({"a": "foo"})],
+                log_event!["b" => "foo"],
+                log_event!["a" => "foo"],
             ),
-            // Facet doesn't exist (negate w/-).
+            // Attribute doesn't exist (negate w/-).
             (
                 "-_missing_:@b",
-                log_event!["custom" => json!({"b": "foo"})],
-                log_event!["custom" => json!({"a": "foo"})],
+                log_event!["b" => "foo"],
+                log_event!["a" => "foo"],
             ),
             // Keyword.
             ("bla", log_event!["message" => "bla"], log_event![]),
@@ -543,55 +541,55 @@ mod test {
             (
                 r#"a:"bla""#,
                 log_event!["tags" => vec!["a:bla"]],
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
             ),
             // Quoted tag match (negate).
             (
                 r#"NOT a:"bla""#,
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
                 log_event!["tags" => vec!["a:bla"]],
             ),
             // Quoted tag match (negate w/-).
             (
                 r#"-a:"bla""#,
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
                 log_event!["tags" => vec!["a:bla"]],
             ),
-            // Facet match.
+            // Attribute match.
             (
                 "@a:bla",
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
                 log_event!["tags" => vec!["a:bla"]],
             ),
-            // Facet match (negate).
+            // Attribute match (negate).
             (
                 "NOT @a:bla",
                 log_event!["tags" => vec!["a:bla"]],
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
             ),
-            // Facet match (negate w/-).
+            // Attribute match (negate w/-).
             (
                 "-@a:bla",
                 log_event!["tags" => vec!["a:bla"]],
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
             ),
-            // Quoted facet match.
+            // Quoted attribute match.
             (
                 r#"@a:"bla""#,
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
                 log_event!["tags" => vec!["a:bla"]],
             ),
-            // Quoted facet match (negate).
+            // Quoted attribute match (negate).
             (
                 r#"NOT @a:"bla""#,
                 log_event!["tags" => vec!["a:bla"]],
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
             ),
-            // Quoted facet match (negate w/-).
+            // Quoted attribute match (negate w/-).
             (
                 r#"-@a:"bla""#,
                 log_event!["tags" => vec!["a:bla"]],
-                log_event!["custom" => json!({"a": "bla"})],
+                log_event!["a" => "bla"],
             ),
             // Wildcard prefix.
             (
@@ -630,23 +628,15 @@ mod test {
                 log_event!["message" => "blafoo"],
             ),
             // Multiple wildcards.
-            (
-                "*b*la*",
-                log_event!["custom" => json!({"title": "foobla"})],
-                log_event![],
-            ),
+            ("*b*la*", log_event!["message" => "foobla"], log_event![]),
             // Multiple wildcards (negate).
             (
                 "NOT *b*la*",
                 log_event![],
-                log_event!["custom" => json!({"title": "foobla"})],
+                log_event!["message" => "foobla"],
             ),
             // Multiple wildcards (negate w/-).
-            (
-                "-*b*la*",
-                log_event![],
-                log_event!["custom" => json!({"title": "foobla"})],
-            ),
+            ("-*b*la*", log_event![], log_event!["message" => "foobla"]),
             // Wildcard prefix - tag.
             (
                 "a:*bla",
@@ -701,59 +691,59 @@ mod test {
                 log_event!["custom" => r#"{"title": "foobla"}"#],
                 log_event!["tags" => vec!["c:foobla"]],
             ),
-            // Wildcard prefix - facet.
+            // Wildcard prefix - attribute.
             (
                 "@a:*bla",
-                log_event!["custom" => json!({"a": "foobla"})],
+                log_event!["a" => "foobla"],
                 log_event!["tags" => vec!["a:foobla"]],
             ),
-            // Wildcard prefix - facet (negate).
+            // Wildcard prefix - attribute (negate).
             (
                 "NOT @a:*bla",
                 log_event!["tags" => vec!["a:foobla"]],
-                log_event!["custom" => json!({"a": "foobla"})],
+                log_event!["a" => "foobla"],
             ),
-            // Wildcard prefix - facet (negate w/-).
+            // Wildcard prefix - attribute (negate w/-).
             (
                 "-@a:*bla",
                 log_event!["tags" => vec!["a:foobla"]],
-                log_event!["custom" => json!({"a": "foobla"})],
+                log_event!["a" => "foobla"],
             ),
-            // Wildcard suffix - facet.
+            // Wildcard suffix - attribute.
             (
                 "@b:bla*",
-                log_event!["custom" => json!({"b": "blabop"})],
+                log_event!["b" => "blabop"],
                 log_event!["tags" => vec!["b:blabop"]],
             ),
-            // Wildcard suffix - facet (negate).
+            // Wildcard suffix - attribute (negate).
             (
                 "NOT @b:bla*",
                 log_event!["tags" => vec!["b:blabop"]],
-                log_event!["custom" => json!({"b": "blabop"})],
+                log_event!["b" => "blabop"],
             ),
-            // Wildcard suffix - facet (negate w/-).
+            // Wildcard suffix - attribute (negate w/-).
             (
                 "-@b:bla*",
                 log_event!["tags" => vec!["b:blabop"]],
-                log_event!["custom" => json!({"b": "blabop"})],
+                log_event!["b" => "blabop"],
             ),
-            // Multiple wildcards - facet.
+            // Multiple wildcards - attribute.
             (
                 "@c:*b*la*",
-                log_event!["custom" => json!({"c": "foobla"})],
+                log_event!["c" => "foobla"],
                 log_event!["tags" => vec!["c:foobla"]],
             ),
-            // Multiple wildcards - facet (negate).
+            // Multiple wildcards - attribute (negate).
             (
                 "NOT @c:*b*la*",
                 log_event!["tags" => vec!["c:foobla"]],
-                log_event!["custom" => json!({"c": "foobla"})],
+                log_event!["c" => "foobla"],
             ),
-            // Multiple wildcards - facet (negate w/-).
+            // Multiple wildcards - attribute (negate w/-).
             (
                 "-@c:*b*la*",
                 log_event!["tags" => vec!["c:foobla"]],
-                log_event!["custom" => json!({"c": "foobla"})],
+                log_event!["c" => "foobla"],
             ),
             // Special case for tags.
             (
@@ -905,62 +895,50 @@ mod test {
                 log_event!["tags" => vec!["b:test"]],
                 log_event!["tags" => vec!["a:test"]],
             ),
-            // Range - numeric, inclusive, facet.
-            (
-                "@b:[1 TO 10]",
-                log_event!["custom" => json!({"b": 5})],
-                log_event!["custom" => json!({"b": 11})],
-            ),
+            // Range - numeric, inclusive, attribute.
+            ("@b:[1 TO 10]", log_event!["b" => 5], log_event!["b" => 11]),
             (
                 "@b:[1 TO 100]",
-                log_event!["custom" => json!({"b": "10"})],
-                log_event!["custom" => json!({"b": "2"})],
+                log_event!["b" => "10"],
+                log_event!["b" => "2"],
             ),
-            // Range - numeric, inclusive, facet (negate).
+            // Range - numeric, inclusive, attribute (negate).
             (
                 "NOT @b:[1 TO 10]",
-                log_event!["custom" => json!({"b": 11})],
-                log_event!["custom" => json!({"b": 5})],
+                log_event!["b" => 11],
+                log_event!["b" => 5],
             ),
             (
                 "NOT @b:[1 TO 100]",
-                log_event!["custom" => json!({"b": "2"})],
-                log_event!["custom" => json!({"b": "10"})],
-            ),
-            // Range - numeric, inclusive, facet (negate w/-).
-            (
-                "-@b:[1 TO 10]",
-                log_event!["custom" => json!({"b": 11})],
-                log_event!["custom" => json!({"b": 5})],
+                log_event!["b" => "2"],
+                log_event!["b" => "10"],
             ),
+            // Range - numeric, inclusive, attribute (negate w/-).
+            ("-@b:[1 TO 10]", log_event!["b" => 11], log_event!["b" => 5]),
             (
                 "NOT @b:[1 TO 100]",
-                log_event!["custom" => json!({"b": "2"})],
-                log_event!["custom" => json!({"b": "10"})],
-            ),
-            // Range - alpha, inclusive, facet.
-            (
-                "@b:[a TO z]",
-                log_event!["custom" => json!({"b": "c"})],
-                log_event!["custom" => json!({"b": 5})],
+                log_event!["b" => "2"],
+                log_event!["b" => "10"],
             ),
-            // Range - alphanumeric, inclusive, facet.
+            // Range - alpha, inclusive, attribute.
+            ("@b:[a TO z]", log_event!["b" => "c"], log_event!["b" => 5]),
+            // Range - alphanumeric, inclusive, attribute.
             (
                 r#"@b:["1" TO "100"]"#,
-                log_event!["custom" => json!({"b": "10"})],
-                log_event!["custom" => json!({"b": "2"})],
+                log_event!["b" => "10"],
+                log_event!["b" => "2"],
             ),
-            // Range - alphanumeric, inclusive, facet (negate).
+            // Range - alphanumeric, inclusive, attribute (negate).
             (
                 r#"NOT @b:["1" TO "100"]"#,
-                log_event!["custom" => json!({"b": "2"})],
-                log_event!["custom" => json!({"b": "10"})],
+                log_event!["b" => "2"],
+                log_event!["b" => "10"],
             ),
-            // Range - alphanumeric, inclusive, facet (negate).
+            // Range - alphanumeric, inclusive, attribute (negate).
             (
                 r#"-@b:["1" TO "100"]"#,
-                log_event!["custom" => json!({"b": "2"})],
-                log_event!["custom" => json!({"b": "10"})],
+                log_event!["b" => "2"],
+                log_event!["b" => "10"],
             ),
             // Range - tag, exclusive.
             (
@@ -995,38 +973,34 @@ mod test {
                 log_event!["tags" => vec!["f:100"]],
                 log_event!["tags" => vec!["f:10"]],
             ),
-            // Range - facet, exclusive.
-            (
-                "@f:{1 TO 100}",
-                log_event!["custom" => json!({"f": 50})],
-                log_event!["custom" => json!({"f": 1})],
-            ),
+            // Range - attribute, exclusive.
+            ("@f:{1 TO 100}", log_event!["f" => 50], log_event!["f" => 1]),
             (
                 "@f:{1 TO 100}",
-                log_event!["custom" => json!({"f": 50})],
-                log_event!["custom" => json!({"f": 100})],
+                log_event!["f" => 50],
+                log_event!["f" => 100],
             ),
-            // Range - facet, exclusive (negate).
+            // Range - attribute, exclusive (negate).
             (
                 "NOT @f:{1 TO 100}",
-                log_event!["custom" => json!({"f": 1})],
-                log_event!["custom" => json!({"f": 50})],
+                log_event!["f" => 1],
+                log_event!["f" => 50],
             ),
             (
                 "NOT @f:{1 TO 100}",
-                log_event!["custom" => json!({"f": 100})],
-                log_event!["custom" => json!({"f": 50})],
+                log_event!["f" => 100],
+                log_event!["f" => 50],
             ),
-            // Range - facet, exclusive (negate w/-).
+            // Range - attribute, exclusive (negate w/-).
             (
                 "-@f:{1 TO 100}",
-                log_event!["custom" => json!({"f": 1})],
-                log_event!["custom" => json!({"f": 50})],
+                log_event!["f" => 1],
+                log_event!["f" => 50],
             ),
             (
                 "-@f:{1 TO 100}",
-                log_event!["custom" => json!({"f": 100})],
-                log_event!["custom" => json!({"f": 50})],
+                log_event!["f" => 100],
+                log_event!["f" => 50],
             ),
         ]
     }
@@ -1043,7 +1017,7 @@ mod test {
         let checks = get_checks();
 
         for (source, pass, fail) in checks {
-            let node = parse(source).unwrap();
+            let node: QueryNode = source.parse().unwrap();
             let matcher = build_matcher(&node, &filter);
 
             assert!(matcher.run(&processor(pass)));
@@ -1076,16 +1050,16 @@ mod test {
 
             assert!(
                 cond.check_with_context(pass.clone()).0.is_ok(),
-                "should pass: {}\nevent: {:?}",
+                "should pass: {}\nevent: {}",
                 source,
-                pass.as_log()
+                serde_json::to_string(&pass.as_log()).unwrap(),
             );
 
             assert!(
                 cond.check_with_context(fail.clone()).0.is_err(),
-                "should fail: {}\nevent: {:?}",
+                "should fail: {}\nevent: {}",
                 source,
-                fail.as_log()
+                serde_json::to_string(&fail.as_log()).unwrap(),
             );
         }
     }
diff --git a/website/cue/reference/remap/functions/match_datadog_query.cue b/website/cue/reference/remap/functions/match_datadog_query.cue
index afb7b39a7f361..bef981f5792e6 100644
--- a/website/cue/reference/remap/functions/match_datadog_query.cue
+++ b/website/cue/reference/remap/functions/match_datadog_query.cue
@@ -39,9 +39,9 @@ remap: functions: match_datadog_query: {
 			return: false
 		},
 		{
-			title: "Facet wildcard"
+			title: "Attribute wildcard"
 			source: #"""
-				match_datadog_query({"custom": {"name": "foo"}}, "@name:foo*")
+				match_datadog_query({"name": "foobar"}, "@name:foo*")
 				"""#
 			return: true
 		},