diff --git a/pkg/generators/forwarding/fluentd/fluent_conf_test.go b/pkg/generators/forwarding/fluentd/fluent_conf_test.go
index c893150e14..081b0c341d 100644
--- a/pkg/generators/forwarding/fluentd/fluent_conf_test.go
+++ b/pkg/generators/forwarding/fluentd/fluent_conf_test.go
@@ -352,6 +352,15 @@ var _ = Describe("Generating fluentd config", func() {
 					</record>
 					remove_keys req,res,msg,name,level,v,pid,err
 				</filter>
+
+				<filter k8s-audit.log**>
+				  @type record_transformer
+				  <record>
+				    k8s_audit_level ${record['level']}
+				  </record>
+				  remove_keys level
+				</filter>
+
 				<filter **>
 					@type viaq_data_model
 					elasticsearch_index_prefix_field 'viaq_index_name'
@@ -765,6 +774,15 @@ var _ = Describe("Generating fluentd config", func() {
 					</record>
 					remove_keys req,res,msg,name,level,v,pid,err
 				</filter>
+
+				<filter k8s-audit.log**>
+				  @type record_transformer
+				  <record>
+				    k8s_audit_level ${record['level']}
+				  </record>
+				  remove_keys level
+				</filter>
+
 				<filter **>
 					@type viaq_data_model
 					elasticsearch_index_prefix_field 'viaq_index_name'
@@ -1564,6 +1582,14 @@ var _ = Describe("Generating fluentd config", func() {
         remove_keys req,res,msg,name,level,v,pid,err
       </filter>
     
+      <filter k8s-audit.log**>
+        @type record_transformer
+        <record>
+          k8s_audit_level ${record['level']}
+        </record>
+        remove_keys level
+      </filter>
+
       <filter **>
         @type viaq_data_model
         elasticsearch_index_prefix_field 'viaq_index_name'
diff --git a/pkg/generators/forwarding/fluentd/output_conf_legacy_test.go b/pkg/generators/forwarding/fluentd/output_conf_legacy_test.go
index 89938235f6..e682a784a5 100644
--- a/pkg/generators/forwarding/fluentd/output_conf_legacy_test.go
+++ b/pkg/generators/forwarding/fluentd/output_conf_legacy_test.go
@@ -299,6 +299,14 @@ var _ = Describe("Generating fluentd legacy output store config blocks", func()
             remove_keys req,res,msg,name,level,v,pid,err
           </filter>
 
+          <filter k8s-audit.log**>
+            @type record_transformer
+            <record>
+              k8s_audit_level ${record['level']}
+            </record>
+            remove_keys level
+          </filter>
+
           <filter **>
             @type viaq_data_model
             elasticsearch_index_prefix_field 'viaq_index_name'
@@ -739,6 +747,14 @@ var _ = Describe("Generating fluentd legacy output store config blocks", func()
             remove_keys req,res,msg,name,level,v,pid,err
           </filter>
 
+          <filter k8s-audit.log**>
+            @type record_transformer
+            <record>
+              k8s_audit_level ${record['level']}
+            </record>
+            remove_keys level
+          </filter>
+
           <filter **>
             @type viaq_data_model
             elasticsearch_index_prefix_field 'viaq_index_name'
@@ -1180,6 +1196,14 @@ var _ = Describe("Generating fluentd legacy output store config blocks", func()
             remove_keys req,res,msg,name,level,v,pid,err
           </filter>
 
+          <filter k8s-audit.log**>
+            @type record_transformer
+            <record>
+              k8s_audit_level ${record['level']}
+            </record>
+            remove_keys level
+          </filter>
+
           <filter **>
             @type viaq_data_model
             elasticsearch_index_prefix_field 'viaq_index_name'
diff --git a/pkg/generators/forwarding/fluentd/templates.go b/pkg/generators/forwarding/fluentd/templates.go
index af086bda7b..ce611065f4 100644
--- a/pkg/generators/forwarding/fluentd/templates.go
+++ b/pkg/generators/forwarding/fluentd/templates.go
@@ -210,6 +210,14 @@ const fluentConfTemplate = `{{- define "fluentConf" -}}
     remove_keys req,res,msg,name,level,v,pid,err
   </filter>
 
+  <filter k8s-audit.log**>
+    @type record_transformer
+    <record>
+      k8s_audit_level ${record['level']}
+    </record>
+    remove_keys level
+  </filter>
+
   <filter **>
     @type viaq_data_model
     elasticsearch_index_prefix_field 'viaq_index_name'