Some customers have quite big audit messages, as they can contain information provided by external authentication systems, like LDAP/Active Directory. Some audit analysis systems are truncating big messages, making them unusable if they are too big. Adding the ability to select the included fields in the audit messages, for instance by allowing users to define a projection on them, would not only fix this issue, but would also allow to redact audit messages where needed.

It would certainly be useful if these projections could depend on the type of message and on the content of other fields.