filterlog pfsense-wrapped filterlog\S* \S*,\S*,\S*,(\S*),\S*,\S*,(\S*), id,action pfsense-wrapped \S*,\S*,\S*,\S*,\S*,\S*,\S*,\S*,\S*,(\S*),\S*,(\S*),(\S*), protocol,srcip,dstip pfsense-wrapped (\d*),(\d*),\S* srcport,dstport pfsense-wrapped datalength=(\S*)|(\d*) length postfix\(\d+\): \w+ \d+ \d+:\d+:\d+ \w+ \.+\(\d+\): mailcow-journald-unwrap \.+ extra_data gitea gitea Failed authentication attempt Failed authentication attempt for (\S+) from (\d+.\d+.\d+.\d+) user, srcip dovecot rip=(\S+), srcip postfix postfix/\S+smtpd\S*: warning: \S+: SASL unknown\[((\d+\.\d+\.\d+)\.\d+)\]: SASL \S+ authentication failed.*sasl_username=(\S+) srcip, src_subnet, dstuser