I am trying to get my Fail2ban filter working for my custom NGINX log format in JSON. But I’m getting 0 results using the “fail2ban-regex” test.

Anyone know how I can resolve this?

Here are my files:

NGINX access.log file entries look like this:

{"source": "nginx", "date": "2024-06-09T16:51:54+02:00", "clientIpAddress": "141.xx.xx.xx", "clientCountryCode": "LT", "requestProtocol": "HTTP/2.0", "requestMethod": "GET", "responseStatusCode": 404, "host": "xxxx.com", "requestURI": "/wp-content/", "referrer": "", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0", "contentType": "", "bytesSent": "200", "requestLength": "247", "requestDuration": "0.004"}

And this is my filter file:

[Definition]
failregex = ^{"source": "nginx", "date": ".*", "clientIpAddress": "<HOST>", .* "responseStatusCode": "(301|400|404|405)", .*}$
ignoreregex =

And in case anyone wonders, here is my NGINX jail:

[nginx]
backend = auto
enabled = true
port = http,https
filter = nginx
logpath = /var/log/nginx/access.log
maxretry = 10
findtime = 300
bantime = 3600
ignoreip = 127.0.0.1/8 ::1/128 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12 169.254.0.0/16

I expect to capture a lot of bots that were spamming my site. I have over 1000 entries with such spam which should be caught. But when I run fail2ban-regex:

sudo fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/nginx.conf 

It returns:** Lines: 1041 lines, 0 ignored, 0 matched, 1041 missed**

What I want is to capture users that get error 301, 400, 404 or 405 too many times.