When a message is formatted as json, it is automatically turned into attributes. It seems like attributes cant be queried without first being turned into facets (which only applies to new log lines, and means you sometimes have to see something show up, then facetize it, then debug it).
Is there a way to query the message directly, bypassing the attribute facet requirement?
It is not possible no. Confirmed with DD support.