Defining rules for audit log filter component (v8.0 / 8.4)

Dear Percona community,

I am struggling to configure the rules for the audit log filter component. I would like to filter events in a way that only certain sql commands are logged.
This is what I have so far:
“filter”: {
“class”:
{
“name”: “query”,
“event”: {
“name”: “start”
}
}
}

This filter successfully logs all query_start events in the class query. I now want to add functionality so that only the following sql commands are logged:
SELECT
CREATE TABLE
DROP TABLE
I tried to do this by accessing the “sql_command”-field but could not get it to work.
Could someone help me with this? Thank you all :slight_smile: