Hello @redssr,
The plugin component records log messages by “class” and the class that captures the queries doesn’t display the username who is running the queries but displays a connection identifier. You therefore need at least 2 classes in your filter definition to do what your’re looking for.
May be you can test this filter :
{
"filter": {
"class": [
{ "name": "connection", "log": true },
{
"name": "query",
"event": {
"name": ["start", "status_end"],
"log": {
"not": {
"or": [
{ "function": {
"name": "string_find",
"args": [{"string": {"field": "sql_command_id"}}, {"string": {"string": "show_"}}]
}},
{ "field": { "name": "sql_command_id", "value": "select"} }
]
}
}
}
}
]
}
}