1. The spec says the action is called "dropIndexes". In the audit log file,
though, it's called "dropIndex" (singular). I think the log file is right
and the spec is wrong, since this action drops one index, not several.

 
      {u'remote': {u'ip': u'127.0.0.1', u'port': 59920}, u'users':
      [{u'userSource': u'db40\u0586', u'user': u'user41\u05d0'}], u'atype':
      u'dropIndex', u'ts': datetime.datetime(2013, 10, 29, 14, 44, 55, 457000,
      tzinfo=<bson.tz_util.FixedOffset object at 0x276ec10>), u'param':
      {u'ns': u'db40\u0586.c42\u0628', u'indexName':
      u'db40\u0586.c42\u0628.$indexname44\u05d0\u03c9'}, u'result': 0,
      u'local': {u'ip': u'127.0.0.1', u'port': 27017}, u'id': {u'opnum': 0,
      u'connid': ObjectId('000000000000000000000000')}} 

2. The indexName field for the bson formatted audit of the dropIndexes action has the form
db40.c42.$indexname44 — with database and collection names and a mysterious
'$' attached to it. (For createIndex, it's just the bare name, like
index44, without those things.)
Since we have an 'ns' field with the same information in the 'param' part
of the audit log record, I think we don't need to put these prefixes on the
indexName here.
u'param':

,

3. The same goes for text formatted audit logs. They look like this:

            2013-10-29T10:53:50.907-0400 user14ऊ@db13אω
            127.0.0.1:59949/127.0.0.1:27017 000000000000000000000000.0 Dropped
            index db13אω.c15இ.$indexname17ซ from db13אω.c15இ.

but probably shouldn't have the "db13אω.c15இ.$" on the index name.