[Definition]
# Ex. 2022-12-11 14:28:28.2|Warn|Auth|Auth-Failure ip 192.168.122.1 username 'aa'

failregex = ^.*Auth-Failure ip <ADDR> username '<F-USER>[^']+</F-USER>'