fail2ban.grok

# fail2ban grok pattern

FAIL2BAN_ACT    (Ban|Unban|Found|Restore Ban)
FAIL2BAN_HEAD   %{TIMESTAMP_ISO8601:[fail2ban][timestamp]} fail2ban.%{WORD:[fail2ban][class]}\s*\[%{NUMBER:[fail2ban][pid]}\]: %{LOGLEVEL:[log][level]}

FAIL2BAN_BAN    %{FAIL2BAN_HEAD}\s+\[%{DATA:[fail2ban][service]}\] %{FAIL2BAN_ACT:[fail2ban][action]} %{IP:[fail2ban][source][ip]}
FAIL2BAN_OTHERS %{FAIL2BAN_HEAD}\s+%{GREEDYDATA:message}

###
FAIL2BAN        %{FAIL2BAN_BAN}|%{FAIL2BAN_OTHERS}