Mapping json using promtail

Hi,
I’m trying to parse vault audit log in promtail agent without success, the log format looks like the following:

{"time":"2022-01-03T15:41:14.268680164Z","type":"request","auth":{"client_token":"hmac-sha256:XXXXXXXXXXXXXXX","accessor":"hmac-sha256:YYYYYYYYYYYYYYY","display_name":"root","policies":["root"],"token_policies":["root"],"token_type":"service","token_issue_time":"2020-05-18T12:43:47Z"},"request":{"id":"aaaaaaaa-bbbbbbbb-cccccc-ddddd-eeeeeee","operation":"read","mount_type":"pki","client_token":"hmac-sha256:ZZZZZZZZZZZZZZZZZZZZZZ","client_token_accessor":"hmac-sha256:YYYYYYYYYYYYYYYY","namespace":{"id":"root"},"path":"AAA/cert/aa-b6-cc-zb-2c-32-f4-w4-za-01-1s-3d-11-s0-ed-2e-12-23-33-46","remote_address":"11.222.222.222","client_certificate_serial_number":"4958753495834759387"}}

i’ve tried the following:

  - job_name: vault
    static_configs:
    - labels:
        __path__: /var/log/vault/audit.log
        instance: vault-1
        job: vault
      targets:
      - localhost

    pipeline_stages:
    - json:
        expressions:
          output: log
          timestamp: time
    - timestamp:
        format: RFC3339Nano
        source: time```

Appreciate if someone can assist.