ClusterLogForwarder Prune Filter Not Removing Fields from the Audit Logs

Issue

• When using ClusterLogForwarder with prune filter to remove specific fields from the Kubernetes audit logs does not work
• Only the optional field .hostname is removed; all other fields (.sourceIPs, .requestReceivedTimestamp, .apiVersion, .requestURI, .userAgent, .user.uid, .stage, .stageTimestamp) remain in the logs.

• Prune filter for audit logs is not correctly pruning the list fields. The prune configuration is:

    filters:
    - name: remove-unwanted-fields
      type: prune
      prune:
        in:
        - .requestReceivedTimestamp
        - .apiVersion
        - .requestURI
        - .userAgent
        - .stage
        - .stageTimestamp
   [...]
    pipelines:
    - name: audit-logs
      inputRefs:  
      - audit 
      filterRefs: 
        - remove-unwanted-fields
      outputRefs:
      - ocp-lokistack