MySQL Enterprise Audit "class": [ { "name": "connection" }, { "name": "general" }, { "name": "table_access" } ] } } When multiple instances of a given item appear at the same level within a filter definition, the item values can be combined into a single instance of that item within an array value. The preceding definition can be written like this: Note { "filter": { "class": [ { "name": [ "connection", "general", "table_access" ] } ] } } To select specific event subclasses, use an  event  item containing a  name  item that names the subclasses. The default action for events selected by an  event  item is to log them. For example, this filter enables logging for the named event subclasses: Logging Specific Event Subclasses { "filter": { "class": [ { "name": "connection", "event": [ { "name": "connect" }, { "name": "disconnect" } ] }, { "name": "general" }, { "name": "table_access", "event": [ { "name": "insert" }, { "name": "delete" }, { "name": "update" } ] } ] } } The  event  item can also contain explicit  log  items to indicate whether to log qualifying events. This event  item selects multiple events and explicitly indicates logging behavior for them: "event": [ { "name": "read", "log": false }, { "name": "insert", "log": true }, { "name": "delete", "log": true }, { "name": "update", "log": true } ] 1507 The  event  item can also indicate whether to block qualifying events, if it contains an  abort  item. For details, see Blocking Execution of Specific Events.