The documentation [0] contains "Example audit policy" yaml, in which values of clf.spec.pipeline.inputRefs|outputRefs|filterRefs should be of type array instead for string.

[0] https://docs.openshift.com/container-platform/4.12/logging/log_collection_forwarding/configuring-log-forwarding.html#logging-audit-filtering_configuring-log-forwarding

Below error is faced when configuring clf.spec.pipeline.inputRefs|outputRefs|filterRefs values as string:

Error "Invalid value: "string": spec.pipelines[0].filterRefs in body must be of type array: "string"" for field "spec.pipelines[0].filterRefs". 

The configuration expected to be as below:

  pipelines:
    - filterRefs:
        - my-policy
      inputRefs:
        - audit
      name: my-pipeline
      outputRefs:
        - default