diff --git a/config/filter.d/nextcloud-auth.conf b/config/filter.d/nextcloud-auth.conf
index 3eff0772..acb301b7 100644
--- a/config/filter.d/nextcloud-auth.conf
+++ b/config/filter.d/nextcloud-auth.conf
@@ -13,4 +13,4 @@ before = common.conf
 # based on https://docs.nextcloud.com/server/27/admin_manual/installation/harden_server.html#setup-a-filter-and-a-jail-for-nextcloud
 _groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
 failregex = ^%(__prefix_line)s?\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
-datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
\ No newline at end of file
+datepattern = ^%(__prefix_line)s?\{%(_groupsre)s,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
\ No newline at end of file
diff --git a/config/filter.d/nextcloud-domain.conf b/config/filter.d/nextcloud-domain.conf
index b73164bd..b077b07a 100644
--- a/config/filter.d/nextcloud-domain.conf
+++ b/config/filter.d/nextcloud-domain.conf
@@ -14,4 +14,4 @@ before = common.conf
 # based on https://docs.nextcloud.com/server/27/admin_manual/installation/harden_server.html#setup-a-filter-and-a-jail-for-nextcloud
 _groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
 failregex = ^%(__prefix_line)s?\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
-datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
\ No newline at end of file
+datepattern = ^%(__prefix_line)s?\{%(_groupsre)s,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
\ No newline at end of file