diff --git a/etc/swift_audit_map.yaml b/etc/swift_audit_map.yaml
index f6c9efa..3e6adf6 100644
--- a/etc/swift_audit_map.yaml
+++ b/etc/swift_audit_map.yaml
@@ -1,7 +1,8 @@
 service_type: 'storage/object'
 service_name: 'swift'
 
-prefix: '/v1'
+# The prefix is v1, but prefix: '/v1/AUTH_[0-9a-z-]*' is intriguing because of the weird resource beginning that matches to a project uuid i believe.
+prefix: '/v1/AUTH_(?P<project_id>[0-9a-f\-]+)'
 
 resources:
   accounts: