You need to illustrate actual data (column format or raw, in text, anonymize as needed). Then, explain which command in your search "deducts" (I assume it means to remove) said events? I don't see any logic to eliminate "user.lifecycle.delete.completed". Also, how does this string relate to data fields?
