[gitlab-sshd]
enabled  = true
filter   = sshd[mode=aggressive]
port     = 2222
logpath  = /srv/gitlab/logs/sshd/current
logtimezone = UTC
datepattern = ^%%Y-%%m-%%d_%%H:%%M:%%S(?:\.%%f)?
prefregex = ^<F-MLFID>\s*</F-MLFID><F-CONTENT>.+</F-CONTENT>$
maxretry = 5
