From 6104444bb4bbe96a2a44d16c38c1dfd13626b219 Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <serg.brester@sebres.de>
Date: Tue, 1 Apr 2025 17:28:58 +0200
Subject: [PATCH] improve regex (anchored from left, no catch-alls, `<ADDR>`
 for IP, etc)

---
 config/filter.d/vaultwarden.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/vaultwarden.conf b/config/filter.d/vaultwarden.conf
index 325395a6..63d78937 100644
--- a/config/filter.d/vaultwarden.conf
+++ b/config/filter.d/vaultwarden.conf
@@ -4,5 +4,5 @@
 
 [Definition]
 
-failregex = \[vaultwarden::api::(identity||admin||core::two_factor::authenticator)\]\[ERROR\] (Invalid admin token||Invalid TOTP code||Username or password is incorrect)(.*) IP: <HOST>(?:\. Username: <F-USER>.+</F-USER>\.)?$
+failregex = ^\s*(?:\[\]\s*)?\[vaultwarden::api::(identity||admin||core::two_factor::authenticator)\]\[ERROR\] (Invalid admin token||Invalid TOTP code||Username or password is incorrect)[\.!](?:\s+(?!IP:)\S+)* IP: <ADDR>(?:\. Username: <F-USER>\S+</F-USER>)?
 ignoreregex =