The log entry that appears to be written when a failed login attempt occurs in v11 using nginx as web server is this:
58.6.199.94 - - [03/Feb/2018:09:44:54 +0000] "POST /web/login HTTP/1.1" 200 3339 "http://www.domain.com/web/login" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:58.0) Gecko/20100101 Firefox/58.0"
How can I write a failregex rule in a fail2ban filter that would adequately detect that log pattern?