diff --git a/apps/emqx_ctl/src/emqx_ctl.erl b/apps/emqx_ctl/src/emqx_ctl.erl
index 4947a9715..8b3eb8058 100644
--- a/apps/emqx_ctl/src/emqx_ctl.erl
+++ b/apps/emqx_ctl/src/emqx_ctl.erl
@@ -146,7 +146,7 @@ run_command(Cmd, Args) when is_atom(Cmd) ->
     audit_log(
         audit_level(Result, Duration),
         "from_cli",
-        #{duration_ms => Duration, result => Result, cmd => Cmd, args => Args, node => node()}
+        #{duration_ms => Duration, cmd => Cmd, args => Args, node => node()}
     ),
     Result.
 
@@ -350,8 +350,6 @@ audit_log(Level, From, Log) ->
 
 -define(TOO_SLOW, 3000).
 
-audit_level(ok, Duration) when Duration >= ?TOO_SLOW -> warning;
-audit_level({ok, _}, Duration) when Duration >= ?TOO_SLOW -> warning;
 audit_level(ok, _Duration) -> info;
 audit_level({ok, _}, _Duration) -> info;
 audit_level(_, _) -> error.
diff --git a/apps/emqx_dashboard/src/emqx_dashboard_audit.erl b/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
index e9c119512..5fdc68f70 100644
--- a/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
+++ b/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
@@ -43,8 +43,7 @@ from(jwt_token) -> "dashboard";
 from(api_key) -> "aip_key";
 from(_) -> "unauthorized".
 
-level(_, _Code, Duration) when Duration > 3000 -> warning;
-level(get, Code, _) when Code >= 200 andalso Code < 300 -> debug;
+level(get, _Code, _) -> debug;
 level(_, Code, _) when Code >= 200 andalso Code < 300 -> info;
 level(_, Code, _) when Code >= 300 andalso Code < 400 -> warning;
 level(_, Code, _) when Code >= 400 andalso Code < 500 -> error;
diff --git a/apps/emqx_enterprise/src/emqx_enterprise_schema.erl b/apps/emqx_enterprise/src/emqx_enterprise_schema.erl
index 9c381d928..248c47e99 100644
--- a/apps/emqx_enterprise/src/emqx_enterprise_schema.erl
+++ b/apps/emqx_enterprise/src/emqx_enterprise_schema.erl
@@ -28,7 +28,24 @@ fields("node") ->
 fields("log") ->
     redefine_log(emqx_conf_schema:fields("log"));
 fields("log_audit_handler") ->
+    CommonConfs = emqx_conf_schema:log_handler_common_confs(file, #{}),
+    CommonConfs1 = lists:filter(
+        fun({Key, _}) ->
+            not lists:member(Key, ["level", "formatter"])
+        end,
+        CommonConfs
+    ),
     [
+        {"level",
+            hoconsc:mk(
+                emqx_conf_schema:log_level(),
+                #{
+                    default => info,
+                    desc => ?DESC(emqx_conf_schema, "audit_handler_level"),
+                    importance => ?IMPORTANCE_HIDDEN
+                }
+            )},
+
         {"path",
             hoconsc:mk(
                 emqx_conf_schema:file(),
@@ -62,16 +79,7 @@ fields("log_audit_handler") ->
                     importance => ?IMPORTANCE_MEDIUM
                 }
             )}
-    ] ++
-        %% Only support json
-        lists:keydelete(
-            "formatter",
-            1,
-            emqx_conf_schema:log_handler_common_confs(
-                file,
-                #{level => info, level_desc => "audit_handler_level"}
-            )
-        );
+    ] ++ CommonConfs1;
 fields(Name) ->
     ee_delegate(fields, ?EE_SCHEMA_MODULES, Name).