Audit users activity on graylog

Don’t confuse web server logs, and audit logs.
I don’t familiar with java logging, so I don’t know. But I’m sure, you can’t filter for eg. stream create.
As I mentioned, you need to analyle the logs eg with graylog.