Filter a JSON/NDJSON event log by field/operator/time range; returns matching events. Use when an agent needs to pull matching rows (thresholds, equality, substring, threshold crossings, time windows) out of a log or metrics event list. Body: {events:[...]|"<ndjson>", filter:{field,op,value?,direction?,timeField?,from?,to?,limit?}}. Ops: gt,gte,lt,lte,eq,ne,contains,crosses_threshold. Free demo at POST /demo; docs at /openapi.json.