# Defining rules for audit log filter component (v8.0 / 8.4)

**URL:** <https://forums.percona.com/t/defining-rules-for-audit-log-filter-component-v8-0-8-4/36276>\
**Category:** Percona Server for MySQL 8.0\
**Created:** [January 22, 2025, 9:08am UTC](https://forums.percona.com/t/defining-rules-for-audit-log-filter-component-v8-0-8-4/36276 "2025-01-22T09:08:05Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![dba\_S4dscjz](https://avatars.discourse-cdn.com/v4/letter/d/65b543/32.png) [@dba\_S4dscjz](https://forums.percona.com/u/dba_S4dscjz)\
**Post date:** [April 23, 2025, 11:05am UTC](https://forums.percona.com/t/defining-rules-for-audit-log-filter-component-v8-0-8-4/36276/2 "2025-04-23T11:05:23Z")

</div>

Hell @audit_4852,

I’ve just started a new discussion [Write audit\_log\_filter definitons](https://forums.percona.com/t/write-audit-log-filter-definitons/37704) about writing rules for this component. In your case I think something like this can help you :

```auto
{
  "filter": {
    "class": [
      {
        "name": "query",
        "event": {
          "name": "start",
          "log": {
              "or": [
                { "field": { "name": "sql_command_id", "value": "select"} },
                { "field": { "name": "sql_command_id", "value": "create_table"} },
                { "field": { "name": "sql_command_id", "value": "drop_table"} }
              ]
          }
        }
      }
    ]
  }
}

```

---

_[View the full topic](https://forums.percona.com/t/defining-rules-for-audit-log-filter-component-v8-0-8-4/36276)._