After the transaction command, all events that make up the transaction are stored in the _raw field. The old _raw is gone. Of course, events are only changed for the duration of the search - and not changed on disk.
Try it out, just as you wrote it, but remove the field=transaction part.
... | transaction account startswith="event_type=login" endswith="event_type=logout"
| rex mode=sed "s/oldvalue/newvalue/g"