#
# parse sshguard journal
#

# double quotes there are
[PARSER]
    name   sshguard_attack
    format regex
    regex  ^Attack from "(?<src_ip>[^ ]+)" on service .*$

## CIDR and double quotes there are
#[PARSER]
#    name   sshguard_block_range
#    format regex
#    regex  ^Blocking "(?<src_ip_range>[^ ]+)" for [0-9]+ secs .*$

# CIDR and double quotes there are
[PARSER]
    name   sshguard_block
    format regex
    regex  ^Blocking "(?<src_ip>[^ /]+)/32" for [0-9]+ secs .*$

# seen without CIDR
[PARSER]
    name   sshguard_unblock
    format regex
    regex  ^(?<src_ip>[^:]+): unblocking after .*$