The QUERY event has a position between IP address and connection ID, which seems to be always empty.
At the same time, it does not log the default schema where the query was executed, while I think it should be expected for events of this type.

The test already exists in server_audit.test and the result is recorded as described above:

set global server_audit_incl_ddl_users='odin, dva, tri';

create table t1 (id int);

...

TIME,HOSTNAME,root[root] @ localhost [],,1,QUERY,set global server_audit_incl_ddl_users='odin, dva, tri'

TIME,HOSTNAME,root[root] @ localhost [],,1,QUERY,create table t1 (id int)