diff --git a/apps/emqx_dashboard/src/emqx_dashboard_audit.erl b/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
index 443c62e7c..72b94158d 100644
--- a/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
+++ b/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
@@ -25,22 +25,19 @@ log(Meta0) ->
     Duration = erlang:convert_time_unit(ReqEnd - ReqStart, native, millisecond),
     Level = level(Method, Code, Duration),
     Username = maps:get(username, Meta0, <<"">>),
+    From = from(maps:get(auth_type, Meta0, "")),
     Meta1 = maps:without([req_start, req_end], Meta0),
     Meta2 = Meta1#{time => logger:timestamp(), duration_ms => Duration},
     Meta = emqx_utils:redact(Meta2),
     ?AUDIT(
         Level,
-        rest_api,
-        Meta#{
-            from => from(maps:get(auth_type, Meta0, "")),
-            username => binary_to_list(Username),
-            node => node()
-        }
+        From,
+        Meta#{username => binary_to_list(Username), node => node()}
     ),
     ok.
 
 from(jwt_token) -> "dashboard";
-from(api_key) -> "aip_key";
+from(api_key) -> "rest_api";
 from(_) -> "unauthorized".
 
 level(get, _Code, _) -> debug;
diff --git a/apps/emqx_machine/src/emqx_restricted_shell.erl b/apps/emqx_machine/src/emqx_restricted_shell.erl
index 77806aa85..07f7507eb 100644
--- a/apps/emqx_machine/src/emqx_restricted_shell.erl
+++ b/apps/emqx_machine/src/emqx_restricted_shell.erl
@@ -112,7 +112,7 @@ max_heap_size_warning(MF, Args) ->
 log(_, {?MODULE, prompt_func}, [[{history, _}]]) ->
     ok;
 log(IsAllow, MF, Args) ->
-    ?AUDIT(warning, remote_console, #{
+    ?AUDIT(warning, shell, #{
         time => logger:timestamp(),
         function => MF,
         args => pp_args(Args),