MySQL: how to use audit_log plugin to audit user modification
I found the reason for it, you just need to relogin to database... so audit_log will be able to capture the action.
SELECT audit_log_filter_set_filter('user_modification', 
'{
  &quot;filter&quot;: {
    &quot;class&quot;: {
    &quot;name&quot;: &quot;general&quot;,
      &quot;event&quot;: {
        &quot;name&quot;: &quot;status&quot;,
        &quot;log&quot;: {
          &quot;field&quot;: { &quot;name&quot;: &quot;general_sql_command.str&quot;, &quot;value&quot;: &quot;create_user&quot; }
        }
      }
    }
  }
}') as RESULT;

SELECT audit_log_filter_set_user('%', 'user_modification');