Will make it more obvious. Davkals has an iteration of the UI that makes it a separate field, which will also help.
While this will definitely be slower than something that indexes the contents, you'll be able to store much more in Loki at much lower costs.
For your hosted service, will you put in place any restrictions on, for example, the size of the time range that can be queried?
Also for your hosted service, will the degree of parallelisation vary by pricing tier?
Looks like the Go regex lib, which isn't super performant, so it could potentially be improved if it ends up being an issue.