Filter cloudwatchlogs

Hi, I’m currently trying my hand at Localstack (PRO) and Cloudwatch :wink: I just can’t get it to make the right selection. I log with the json formatter with serilog.
My log output (one message from many) looks like this:
“Level”: “Information”,
“_typeTag”: “ImpoertantMessage”
“SourceContext”: “Client.PersistingMessageClient”,
This is the message . I only want to have logs where _typeTag = “ImpoertantMessage” and a specific userId. This information is in the message within Properties.
However, I also have logs that do not have this structure, i.e. properties are not always present.
What should such a selection look like? I tried it both with the localstack CLI and from C#, but couldn’t get it right.
Thanks for the help!