Count of object keys over time

We have logs that take the form of

{
  ...
  eventA: T
  eventB: T
  diff: Partial<T>
  type: string
  category: string
}

I am trying to create a report that will show how often any of the possible keys are present in the diff, filtered by type and category. I can target the desired logs in the explorer but have no idea how to ‘unnest’ as it were the keys in the diff object to make them countable.

what I have so far:

{container_name="our_container"} | json type = "type", msg = "msg", category="category",  | msg = `log message` | type = `eventName` | category = `category`

Does anyone know how to accomplish this? Any advice is welcome.