I would agree, CloudTrail is a pretty good example. The who what where when why is a good starting point. We're building audit logs as a service and our event format looks similar: https://apptrail.com/docs/applications/guide/event-format