diff --git a/apps/emqx_conf/src/emqx_conf_schema.erl b/apps/emqx_conf/src/emqx_conf_schema.erl
index f1bfc3d31..d1fc6c546 100644
--- a/apps/emqx_conf/src/emqx_conf_schema.erl
+++ b/apps/emqx_conf/src/emqx_conf_schema.erl
@@ -1014,6 +1014,15 @@ fields("log_file_handler") ->
     ] ++ log_handler_common_confs(file, #{});
 fields("log_audit_handler") ->
     [
+        {"level",
+            sc(
+                log_level(),
+                #{
+                    default => info,
+                    desc => ?DESC("audit_handler_level"),
+                    importance => ?IMPORTANCE_HIDDEN
+                }
+            )},
         {"path",
             sc(
                 file(),
@@ -1048,11 +1057,12 @@ fields("log_audit_handler") ->
     ] ++
         %% Only support json
         lists:keydelete(
-            "formatter",
+            "level",
             1,
-            log_handler_common_confs(
-                file,
-                #{level => info, level_desc => "audit_handler_level"}
+            lists:keydelete(
+                "formatter",
+                1,
+                log_handler_common_confs(file, #{})
             )
         );
 fields("log_overload_kill") ->
diff --git a/apps/emqx_ctl/src/emqx_ctl.erl b/apps/emqx_ctl/src/emqx_ctl.erl
index 4947a9715..4c077c56d 100644
--- a/apps/emqx_ctl/src/emqx_ctl.erl
+++ b/apps/emqx_ctl/src/emqx_ctl.erl
@@ -350,8 +350,6 @@ audit_log(Level, From, Log) ->
 
 -define(TOO_SLOW, 3000).
 
-audit_level(ok, Duration) when Duration >= ?TOO_SLOW -> warning;
-audit_level({ok, _}, Duration) when Duration >= ?TOO_SLOW -> warning;
 audit_level(ok, _Duration) -> info;
 audit_level({ok, _}, _Duration) -> info;
 audit_level(_, _) -> error.
diff --git a/apps/emqx_dashboard/src/emqx_dashboard_audit.erl b/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
index e9c119512..5fdc68f70 100644
--- a/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
+++ b/apps/emqx_dashboard/src/emqx_dashboard_audit.erl
@@ -43,8 +43,7 @@ from(jwt_token) -> "dashboard";
 from(api_key) -> "aip_key";
 from(_) -> "unauthorized".
 
-level(_, _Code, Duration) when Duration > 3000 -> warning;
-level(get, Code, _) when Code >= 200 andalso Code < 300 -> debug;
+level(get, _Code, _) -> debug;
 level(_, Code, _) when Code >= 200 andalso Code < 300 -> info;
 level(_, Code, _) when Code >= 300 andalso Code < 400 -> warning;
 level(_, Code, _) when Code >= 400 andalso Code < 500 -> error;