sashatrask
5 lines
255 B
Plaintext
5 lines
255 B
Plaintext
[Definition]
|
|
failregex = ^(?=.{1,1024}$)(?=.*"event"\s*:\s*"admin_auth_failure")(?=.*"status"\s*:\s*401)(?=.*"remote_ip"\s*:\s*"<HOST>")(?!.*"(?:request|uri|headers|authorization|password|token|prefix)"\s*:).*\s*$
|
|
ignoreregex =
|
|
datepattern = "ts":{EPOCH}
|