Beginner logql with vault secrets

My overall goal is to visualize vault secret usage from specific paths and policies ans the concept of filtering is going over my head I suppose. What I think should work when in grafana exploring is the following data from logfile:
“display_name”:“root”,“policies”:[“root”],“token_policies”:[“root”]“path”:“kv/data/test”

and the following matching, but I cant seem to get any key value type of search working
{container=“vault”} |= “kv/data/test”
{container=“vault”} |= “path”:“kv/data/test”
{container=“vault”} |= “kv/data/test”
{container=“vault”} |= “policies”:[“root”]