diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59e49e7..ffd99a8 100755
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All changes to the log analytics integration will be documented in this file.
 
+## [1.0.15] - April 2026
+
+* Fix incorrect field name in access-security-audit log parsing: renamed `token_id` capture group to `trace_id` to match the actual log format documented at https://docs.jfrog.com/administration/docs/audit-trail-log (JOBS-2031)
+
 ## [1.0.14] - April 2026
 
 * Added RTFS (JFrog Artifactory Federation Service) metrics collection support in Artifactory fluentd config (JOBS-1897)
diff --git a/fluent.conf.rt b/fluent.conf.rt
index 3895975..729e470 100644
--- a/fluent.conf.rt
+++ b/fluent.conf.rt
@@ -272,7 +272,7 @@
   tag jfrog.rt.access.audit
   <parse>
     @type regexp
-    expression /^(?<log_timestamp>[^ ]*)\|(?<token_id>[^ ]*)\|(?<user_ip>[^ ]*)\|(?<user>[^ ]*)\|(?<logged_principal>[^ ]*)\|(?<entity_name>[^ ]*)\|(?<event_type>[^ ]*)\|(?<event>[^ ]*)\|(?<data_changed>.*)/
+    expression /^(?<log_timestamp>[^ ]*)\|(?<trace_id>[^ ]*)\|(?<user_ip>[^ ]*)\|(?<user>[^ ]*)\|(?<logged_principal>[^ ]*)\|(?<entity_name>[^ ]*)\|(?<event_type>[^ ]*)\|(?<event>[^ ]*)\|(?<data_changed>.*)/
     time_key log_timestamp
     time_format %Y-%m-%dT%H:%M:%S.%LZ
   </parse>