[INCLUDES] before = common.conf [Definition] failregex=^{"reqId":".*","remoteAddr":"".*message":"Login failed: .*}$