gistfile1.txt

<AUDIT_RECORD>
  <NAME>Query</NAME>
  <RECORD>742037377_2014-05-09T14:25:53</RECORD>
  <TIMESTAMP>2014-05-09T14:27:41 UTC</TIMESTAMP>
  <COMMAND_CLASS>show_variables</COMMAND_CLASS>
  <CONNECTION_ID>3</CONNECTION_ID>
  <STATUS>0</STATUS>
  <SQLTEXT>show global variables like 'audit%'</SQLTEXT>
  <USER>root[root] @ localhost []</USER>
  <HOST>localhost</HOST>
  <OS_USER></OS_USER>
  <IP></IP>
</AUDIT_RECORD>

+++++++++++++++++

input {
        stdin { }
        file {
                type => "mysqlaudit"
                path => ["/var/lib/mysql/audit.log"]
                codec => multiline {
                        pattern => "<AUDIT_RECORD(.*)/>"
                        negate => true
                        what => 'previous'
                        }
                }
}