fields @timestamp
| filter detail.field-value IN ["value1", "value2", "value3"]  # replace field-value and value1, value2, value3 with actual values.
| sort @timestamp desc