diff --git a/core/src/main/scala/tech/beshu/ror/accesscontrol/audit/ecs/EcsV1AuditLogSerializer.scala b/core/src/main/scala/tech/beshu/ror/accesscontrol/audit/ecs/EcsV1AuditLogSerializer.scala
index 104644d769..b2a976e98b 100644
--- a/core/src/main/scala/tech/beshu/ror/accesscontrol/audit/ecs/EcsV1AuditLogSerializer.scala
+++ b/core/src/main/scala/tech/beshu/ror/accesscontrol/audit/ecs/EcsV1AuditLogSerializer.scala
@@ -60,7 +60,7 @@ object EcsV1AuditLogSerializer {
       ),
     ),
     withPrefix("user")(
-      AuditFieldPath("name") -> AuditFieldValueDescriptor.User,
+      AuditFieldPath("name") -> AuditFieldValueDescriptor.LoggedUser,
       withPrefix("effective")(
         AuditFieldPath("name") -> AuditFieldValueDescriptor.ImpersonatedByUser,
       ),