Currently, we cannot filter by role for the audit log. We can filter by user or events, but naturally this becomes problematic when users or events or connections are changed.

We essentially have to do a rolling restart with a new set of filters everytime we add a user or criteria. We could do a "not" query to match all other users but this can be inefficient.