From 1c1a9b868c6c7677c929ede5e8c1cb8f16d3be41 Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <info@sebres.de>
Date: Mon, 9 Nov 2020 15:36:30 +0100
Subject: [PATCH] no catch-alls, user name and error message stored in ticket

---
 config/filter.d/grafana.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/grafana.conf b/config/filter.d/grafana.conf
index 78ded075..e7f0f420 100644
--- a/config/filter.d/grafana.conf
+++ b/config/filter.d/grafana.conf
@@ -6,4 +6,4 @@
 datepattern = ^t=%%Y-%%m-%%dT%%H:%%M:%%S%%z
 
 [Definition]
-failregex = ^.*msg="Invalid username or password".* remote_addr=<ADDR>$
+failregex = ^(?: lvl=err?or)? msg="Invalid username or password"(?: uname=(?:"<F-ALT_USER>[^"]+</F-ALT_USER>"|<F-USER>\S+</F-USER>)| error="<F-ERROR>[^"]+</F-ERROR>"| \S+=(?:\S*|"[^"]+"))* remote_addr=<ADDR>$