docs: document plain text fallback limitations

Author: code-with-auto

README.md

@@ -126,6 +126,9 @@ loq "SELECT path, AVG(response_time) FROM access.log GROUP BY path"
 | **Apache/Nginx** | `192.168.1.1 - - [20/Dec/2024:10:00:00 +0000] "GET /api HTTP/1.1" 200 1234` |
 | **Syslog** | `Dec 20 12:34:56 myhost myapp[1234]: Message` |
 | **CLF** | `127.0.0.1 - - [10/Oct/2000:13:55:36 -0700] "GET / HTTP/1.0" 200 2326` |
+| **Plain text** | Fallback - entire line as `message`, no field extraction |
+
+> **Note:** Plain text mode has limited query support. Use `message contains "ERROR"` instead of `level=error`. For full query capabilities, use structured logging (JSON) or create a custom format.
 
 ### Custom formats
 

docs/guide/log-formats.md

@@ -38,3 +38,30 @@ Dec 20 12:34:56 myhost myapp[1234]: Message here
 ```
 127.0.0.1 - - [10/Oct/2000:13:55:36 -0700] "GET /index.html HTTP/1.0" 200 2326
 ```
+
+## Plain Text (Fallback)
+
+When loq doesn't recognize a log format, it falls back to plain text mode:
+
+```
+Application started successfully
+ERROR: Something went wrong
+[2024-01-15] Custom format not recognized
+```
+
+**Limitations of plain text mode:**
+- The entire line is stored as `message`
+- No `level`, `timestamp`, or other fields are extracted
+- Field-based queries like `level=error` won't match
+
+**Workarounds:**
+
+1. Use `message contains` instead of field queries:
+   ```bash
+   loq app.log where message contains "ERROR"
+   loq app.log where message matches "^ERROR:"
+   ```
+
+2. Create a [custom format](/guide/custom-formats) to properly parse your logs
+
+**Tip:** For best results, use structured logging (JSON) in your applications. This gives you full query capabilities on any field.