Question regex fail2ban joomla 3.5 plesk 12.5

[ericzapata]

Hello,

I have a problem about writing a regex expression for Fail2Ban
I want to protect administrator access a joomla 3.5
The logs give me the following:
[Mon Jun 06 12: 33: 02.268536 2016 ] [ fcgid : warn] [ pid 3700 ] [ 217.128.126.234:43428 client] mod_fcgid : stderr : JCoulot user authentication failure , referer : http://xxxxxxxxx.com/administrator /
and I created a conf file ( joomla-error.conf ) in etc / fail2ban / filter.d /

failregex = ^ \ * \ [* . ] [client < HOST > : [0-9] + \ ] mod_fcgid : stderr . * Joomla user authentication failure , referer : . *

This does not work , could give me advice on writing the regex

thank you in advance

Eric