If you can only answer "who changed this field" by grepping logs after the fact, that's forensics, not audit.
We write audit as a typed changeset with the actor resolved at write time, and keep the diff core free of the ORM so the guarantee is testable on its own. Where does your audit trail actually get written?
https://shipmindlabs.com/blog/an-audit-trail-is-a-typed-changeset-not-a-log-line/