For anyone googling this type of thing later, I found out the answer from Datadog support: it's not possible from the metrics endpoint. The data ingestion app I was creating queries for that consumes the Datadog API only had support for the Metrics (timeseries) endpoint, and the Events endpoint (which is something completely different from these "event" logs).

In order to query these named logs and look at an attribute, there are essentially two options:

1: Use the Logs Analytics Aggregate API Endpoint (https://docs.datadoghq.com/api/latest/logs/), which allows you to query directly into logs and set aggregation type etc. The app I was using did not support this endpoint, but through personal curl requests I was able to verify that the data was accessible through this endpoint. The downside of this endpoint is it has as much lower rate limit than the metric timeseries endpoint (the rate limit is only 300 requests/hour, which we hit fairly fast).

2: Create a new metric representing this attribute in the logs of Datadog. This is the route we took. The downside of this method is that the new metric only begins storing data from the point in time in which it is created, so any historical data you wish to look at will not be available via this new metric.

You need to tell Datadog that you're interested in that content by creating a facet from the field. Click a log message, mouse over the attribute name, click the gear on the left, then Create facet for @...

For logs indexed after you create the facet, you can search with @fieldName:text*, where fieldName is the name of your field. You'll need to re-hydrate (reprocess) earlier logs to make them searchable.

You won't need to create a facet if you use fields from the standard attributes list.