There's a complete prototype of how to do that in my github repository (https://github.com/KELightsey/chamomile/blob/master/presentation/xquery_shredding_a_table).
You'll want to look at that whole example, but the "filter" is based on a cross apply from the XML column like this:
{
--
-- get only the log entries having a data node in any position (//* syntax)
-------------------------------------------------
SELECT *
FROM @entry AS [entry]
CROSS APPLY [entry].[nodes]('/*') AS [table] ( [column] )
WHERE CAST([table].[column].[query]('fn:local-name(.)') AS [SYSNAME]) = N'log'
AND [entry].exist('//*[local-name()="data"]') = 1;
}
Of course you'll want to use a value filter something like:
{
--
-- get only the log entries having a data node in any position (//* syntax)
-------------------------------------------------
SELECT [entry]
, [entry].value(N'(./*/text())[1]', N'nvarchar(max)') AS [value]
, [entry].value(N'(./*/@application)[1]', N'sysname') AS [application]
, [entry].value(N'(./*/@timestamp)[1]', N'datetime') AS [timestamp]
, [entry].query(N'(./*/data/*)[1]') AS [data]
, [entry].value(N'(./*/special_note/text())[1]', N'nvarchar(max)') AS [special_note]
FROM @entry AS [entry]
CROSS APPLY [entry].[nodes]('/*') AS [table] ( [column] )
WHERE CAST([table].[column].[query]('fn:local-name(.)') AS [SYSNAME]) = N'log'
AND [entry].value(N'(./*/text())[1]', N'nvarchar(max)') = 'This is a log item.';
}
That should get you started.