# Audit log file json format

**URL:** <https://forums.percona.com/t/audit-log-file-json-format/39306>\
**Category:** Percona Distribution for MySQL\
**Created:** [September 8, 2025, 7:06pm UTC](https://forums.percona.com/t/audit-log-file-json-format/39306 "2025-09-08T19:06:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [September 8, 2025, 7:06pm UTC](https://forums.percona.com/t/audit-log-file-json-format/39306/1 "2025-09-08T19:06:40Z")

</div>

Is there a way for the audit filter log file to log the same way as the old audit plugin?

I used the json format for the old audit plugin and am using the json format for the audit filter log but they look completely different.

---

<div class="post-metadata">

**Author:** ![yunus.uyanik](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/yunus.uyanik/32/19250_2.png) [@yunus.uyanik](https://forums.percona.com/u/yunus.uyanik)\
**Post date:** [September 16, 2025, 7:06am UTC](https://forums.percona.com/t/audit-log-file-json-format/39306/2 "2025-09-16T07:06:56Z")

</div>

Hi @ipcmlr

They both use JSON, but the audit filter log component has a new structure (and also it uses JSON array), which is why it seems strange to you. Apart from that, you can’t change it.

Audit Log Plugin

`{“audit_record”:{“name”:“Query”,“record”:“13149_2021-06-30T15:03:11”,“timestamp”:“2021-06-30T15:07:58 UTC”,“command_class”:“show_databases”,“connection_id”:“2”,“status”:0,“sqltext”:“show databases”,“user”:“root[root] @ localhost ``”,“host”:“localhost”,“os_user”:“”,“ip”:“”,“db”:“”}}`

Audit Log Filter Component:

`[ { "timestamp": "2023-03-29 11:17:03", "id": 0, "class": "audit", "server_id": 1 }, { "timestamp": "2023-03-29 11:17:05", "id": 1, "class": "command", "event": "command_start", "connection_id": 1, "command_data": { "name": "command_start", "status": 0, "command": "query"} },`…

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [September 22, 2025, 2:15pm UTC](https://forums.percona.com/t/audit-log-file-json-format/39306/3 "2025-09-22T14:15:54Z")

</div>

Thanks. Was hoping that I would not need to rewrite auditing scripts. thanks.