Description of problem: (+ expectation from this jira)

The ".auditID" field is not maintained when mentioned in .notIN for Audit, it has to be mentioned as ".structured.auditID" 

When prune filter is not used it appears in Observe>Loki just as "auditID"

auditID 0decf002-e40e-4250-a907-cb17f82bcba3 

New users unfamiliar with vector.toml pipelines often struggle to understand that the 'structured' parameter is required to ensure field auditID is preserved in the output.

If this is expected there should be list of such fields  in doc : https://issues.redhat.com/browse/OBSDOCS-2359

If its not expected then it should be worked upon

Version-Release number of selected component (if applicable):

Logging 6.4, Loki 6.4

How reproducible:

Always

Steps to Reproduce:

1. Create logging and lokistack
2. Create CLF with just .auditID in notIn 
3. Modify CLF .auditID to .structured.auditID