when choosing the filter( severity=unknown), the output only includes records with no level field.   There are also lots of records which level=unknown. we should include these records .

And there are also lots of audit logs which level=metadata. Shall we define a severity value:metadata?

Step to Reproduce:

1) Forward logs to lokistack

2) on console: Filter logs via pre-defined severity unknown

3) on console: Filter logs via level=unknown

Actual result:

No records when filter logs via pre-defined severity unknown

Expected result:

The records which level=unknown should be displayed