MySQL Enterprise Audit { "filter": { "class": { "name": "general", "event": { "name": "status", "log": { "or": [ { "and": [ { "field": { "name": "general_command.str", "value": "Query" } }, { "field": { "name": "general_command.length", "value": 5 } } ] }, { "and": [ { "field": { "name": "general_command.str", "value": "Execute" } }, { "field": { "name": "general_command.length", "value": 7 } } ] } ] } } } } } { "filter": { "class": { "name": "general", "event": { "name": "status", "log": { "variable": { "name": "audit_log_connection_policy_value", "value": "::none" 1514 To refer to a predefined variable in a  log  condition, use a  variable  item, which tests equality against a given value: Referencing Predefined Variables Logical operators ( and ,  or ,  not ) can be used in  log  items. This permits construction of more advanced filtering configurations: Logical Operators For attempts to define a filter in which the  abort  item appears elsewhere than in an  event  item, an error occurs. Not all events can be blocked (see Table 6.30, “Log and Abort Characteristics Per Event Class and Subclass Combination” ). For an event that cannot, the audit log writes a warning to the error log rather than blocking it. Statements matched and blocked by the filter return an error to the client: } } } } } ERROR 1045 (28000): Statement was aborted by an audit log filter