to get the service name we'd probably need to take HTTP_HOST value and find the corresponding entry in HTTP_X_SERVICE_CATALOG. (this is what we do in to generate CADF as well)

the full url path isn't part of CADF payload either -- it can be added (as its extensible) but it's not part of formal spec.  i could get Matt to propose to add it to formal spec if you find value there (we've been adding/proposing a bunch of Openstack attr since we've started)

here is what the payload contains right now (the CADF_EVENT attr is there if and only if you use the middleware.audit, middleware.notifier does captures everything else):

RESPONSE

{
	"_id" : ObjectId("5213edc8eb2d733c8ed7d7cd"),
	"counter_name" : "http.response",
	"user_id" : "36448cb2ec454631a6a8cb664a29332f",
	"message_signature" : "ef69c38520c06891bf7a577d663ed41a74a74f6fcc1c3c998c5b558c2631f1c3",
	"timestamp" : ISODate("2013-08-20T22:29:28.482Z"),
	"resource_id" : null,
	"resource_metadata" : {
		"host" : "nova-api.plwdevstack",
		"request" : {
			"HTTP_X_TENANT_NAME" : "service",
			"SCRIPT_NAME" : "/v2",
			"REQUEST_METHOD" : "GET",
			"PATH_INFO" : "/2fb92e2139654e87bc03c42543eababf/os-floating-ips",
			"SERVER_PROTOCOL" : "HTTP/1.0",
			"HTTP_X_USER_ID" : "36448cb2ec454631a6a8cb664a29332f",
			"HTTP_X_AUTH_TOKEN" : "tokenid",
			"HTTP_USER_AGENT" : "python-novaclient",
			"HTTP_X_DOMAIN_NAME" : null,
			"HTTP_X_PROJECT_DOMAIN_ID" : null,
			"REMOTE_PORT" : "48729",
			"HTTP_X_ROLE" : "_member_,admin,ResellerAdmin",
			"HTTP_X_IDENTITY_STATUS" : "Confirmed",
			"HTTP_X_DOMAIN_ID" : null,
			"SERVER_PORT" : "8774",
			"CADF_EVENT" : {
				"typeURI" : "http://schemas.dmtf.org/cloud/audit/1.0/event",
				"eventTime" : "2013-08-20T22:28:18.122305+0000",
				"target" : {
					"typeURI" : "service/compute",
					"addresses" : [
						{
							"url" : "http://10.0.2.15:8774/v2/2fb92e2139654e87bc03c42543eababf",
							"name" : "admin"
						},
						{
							"url" : "http://10.0.2.15:8774/v2/2fb92e2139654e87bc03c42543eababf",
							"name" : "private"
						},
						{
							"url" : "http://10.0.2.15:8774/v2/2fb92e2139654e87bc03c42543eababf",
							"name" : "public"
						}
					],
					"id" : "2f134369e44b4bb0b681551228474203",
					"name" : "nova"
				},
				"observer" : "target",
				"tags" : [
					"correlation_id?value=f36fff90-6b5e-54c2-9438-73dc60c57657"
				],
				"eventType" : "activity",
				"initiator" : {
					"typeURI" : "service/security/account/user",
					"name" : "ceilometer",
					"credential" : {
						"token" : "tokenid",
						"identity_status" : "Confirmed"
					},
					"host" : {
						"agent" : "python-novaclient",
						"address" : "10.0.2.15"
					},
					"project_id" : "2fb92e2139654e87bc03c42543eababf",
					"id" : "36448cb2ec454631a6a8cb664a29332f"
				},
				"reason" : {
					"reasonCode" : "200",
					"reasonType" : "HTTP"
				},
				"reporterchain" : [
					{
						"reporterTime" : "2013-08-20T22:29:28.480996+0000",
						"role" : "modifier",
						"reporter" : "target"
					}
				],
				"action" : "list",
				"outcome" : "success",
				"id" : "c5e63215-9afd-5911-8644-0210448efa5c"
			},
			"HTTP_X_SERVICE_CATALOG" : "[{\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:8774/v2/2fb92e2139654e87bc03c42543eababf\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:8774/v2/2fb92e2139654e87bc03c42543eababf\", \"internalURL\": \"http://10.0.2.15:8774/v2/2fb92e2139654e87bc03c42543eababf\", \"id\": \"2f134369e44b4bb0b681551228474203\"}], \"type\": \"compute\", \"name\": \"nova\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:8776/v2/2fb92e2139654e87bc03c42543eababf\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:8776/v2/2fb92e2139654e87bc03c42543eababf\", \"internalURL\": \"http://10.0.2.15:8776/v2/2fb92e2139654e87bc03c42543eababf\", \"id\": \"5b496aff750940d5b7c3f2f6129a7e5c\"}], \"type\": \"volumev2\", \"name\": \"cinder\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:8774/v3\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:8774/v3\", \"internalURL\": \"http://10.0.2.15:8774/v3\", \"id\": \"5d0dc523c3324843b488296834bb3267\"}], \"type\": \"computev3\", \"name\": \"nova\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:3333\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:3333\", \"internalURL\": \"http://10.0.2.15:3333\", \"id\": \"2bba8016bcf8478f868896952af9d633\"}], \"type\": \"s3\", \"name\": \"s3\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:9292\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:9292\", \"internalURL\": \"http://10.0.2.15:9292\", \"id\": \"09ff713feaa243a68867abcde784bae3\"}], \"type\": \"image\", \"name\": \"glance\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:8777\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:8777\", \"internalURL\": \"http://10.0.2.15:8777\", \"id\": \"04d166257ec04fbdaa70ce10cfcbb8c1\"}], \"type\": \"metering\", \"name\": \"ceilometer\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:8776/v1/2fb92e2139654e87bc03c42543eababf\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:8776/v1/2fb92e2139654e87bc03c42543eababf\", \"internalURL\": \"http://10.0.2.15:8776/v1/2fb92e2139654e87bc03c42543eababf\", \"id\": \"831ff894a8db43db84ee4d1ed3e8cbb5\"}], \"type\": \"volume\", \"name\": \"cinder\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:8773/services/Admin\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:8773/services/Cloud\", \"internalURL\": \"http://10.0.2.15:8773/services/Cloud\", \"id\": \"17977e7e2d504918913bd916196e78ce\"}], \"type\": \"ec2\", \"name\": \"ec2\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:8080\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:8080/v1/AUTH_2fb92e2139654e87bc03c42543eababf\", \"internalURL\": \"http://10.0.2.15:8080/v1/AUTH_2fb92e2139654e87bc03c42543eababf\", \"id\": \"7457330d4cfa4f6587b93b05ec7f6d6b\"}], \"type\": \"object-store\", \"name\": \"swift\"}, {\"endpoints_links\": [], \"endpoints\": [{\"adminURL\": \"http://10.0.2.15:35357/v2.0\", \"region\": \"RegionOne\", \"publicURL\": \"http://10.0.2.15:5000/v2.0\", \"internalURL\": \"http://10.0.2.15:5000/v2.0\", \"id\": \"10bc3cf35d8f469db40420ccb3d3aa14\"}], \"type\": \"identity\", \"name\": \"keystone\"}]",
			"HTTP_X_TENANT_ID" : "2fb92e2139654e87bc03c42543eababf",
			"HTTP_X_PROJECT_DOMAIN_NAME" : null,
			"HTTP_X_USER_DOMAIN_NAME" : null,
			"HTTP_X_USER" : "ceilometer",
			"HTTP_X_USER_DOMAIN_ID" : null,
			"REMOTE_ADDR" : "10.0.2.15",
			"HTTP_HOST" : "10.0.2.15:8774",
			"HTTP_X_AUTH_PROJECT_ID" : "service",
			"HTTP_X_TENANT" : "service",
			"HTTP_ACCEPT" : "application/json",
			"RAW_PATH_INFO" : "/v2/2fb92e2139654e87bc03c42543eababf/os-floating-ips",
			"SERVER_NAME" : "10.0.2.15",
			"CADF_EVENT_CORRELATION_ID" : "f36fff90-6b5e-54c2-9438-73dc60c57657",
			"HTTP_X_PROJECT_NAME" : "service",
			"HTTP_X_PROJECT_ID" : "2fb92e2139654e87bc03c42543eababf",
			"HTTP_X_USER_NAME" : "ceilometer",
			"CONTENT_TYPE" : "text/plain",
			"GATEWAY_INTERFACE" : "CGI/1.1",
			"HTTP_X_ROLES" : "_member_,admin,ResellerAdmin",
			"HTTP_ACCEPT_ENCODING" : "gzip, deflate, compress"
		},
		"response" : {
			"status" : "200 OK",
			"headers" : {
				"Content-Length" : "20",
				"Content-Type" : "application/json",
				"x-compute-request-id" : "req-33891ab0-60ce-408d-a721-9cd946ba40cd"
			}
		},
		"event_type" : "http.response"
	},
	"source" : "openstack",
	"counter_unit" : "response",
	"counter_volume" : 1,
	"project_id" : "2fb92e2139654e87bc03c42543eababf",
	"message_id" : "f9d7ae72-09e7-11e3-a181-080027317d13",
	"counter_type" : "delta"
}