Tailor expressions in filter operation

[dominiklohmann]

📔 Description

We ran into a vast::die call due to an unresolved field extractor when using the filter function with a field extractor. This most notably caused import filter like event_type == "alert" to fail.

📝 Checklist

• All user-facing changes have changelog entries.
• The changes are reflected on docs.tenzir.com/vast, if necessary.
• The PR description contains instructions for the reviewer, if necessary.

🎯 Review Instructions

Commit-by-commit.

[lava]

The fix looks good, but from the description it sounds like we can very easily add the problematic query as a new test.

[lava]

Looks good, thanks for adding the test!