Filter expression parsing relies on hard-coded attributes (IP, ports, etc.). Generalize to use arbitrary attributes.