In both textfile and bsonfile formats of the audit log, a createIndex action is logging more than just the index spec where only the index spec should be.
Here is the line from the textfile:
013-10-28T11:26:27.256-0400 user2@db1,user8Ӝ@db7Ж 127.0.0.1:55833/127.0.0.1:27017 000000000000000000000000.0 Created index indexname11ب on db7Ж.c9ֆ as { v: 1, ns: "db7Ж.c9ֆ", name: "indexname11ب", key: { fld10: 1 } }.
And here is the line from the bsonfile (represented as a python unicode dict):
{u'remote': {u'ip': u'127.0.0.1', u'port': 55831}, u'users': [{u'userSource': u'db1', u'user': u'user2'}, {u'userSource': u'db7\u0416', u'user': u'user8\u04dc'}], u'atype': u'createIndex', u'ts': datetime.datetime(2013, 10, 28, 15, 26, 5, 619000, tzinfo=<bson.tz_util.FixedOffset object at 0x7f2a645c0e10>), u'param': {u'ns': u'db7\u0416.c9\u0586', u'indexName': u'indexname11\u0628', u'key': {u'ns': u'db7\u0416.c9\u0586', u'name': u'indexname11\u0628', u'key': {u'fld10': 1}, u'v': 1}}, u'result': 0, u'local': {u'ip': u'127.0.0.1', u'port': 27017}, u'id': {u'opnum': 0, u'connid': ObjectId('000000000000000000000000')}}
In both cases, a larger object containing the index spec is logged. In other words, the following is being logged:
{ v: 1, ns: "db7Ж.c9ֆ", name: "indexname11ب", key: { fld10: 1 } }
When the following should be logged instead:
{ fld10: 1 }