From 9bf98f1d20d16cbd346aaa520161665290dd3637 Mon Sep 17 00:00:00 2001
From: Kazuhiro MUSASHI <simoom634@yahoo.co.jp>
Date: Sat, 26 Sep 2020 17:08:05 +0900
Subject: [PATCH] Ignore `already banned` message.

---
 cookbooks/promtail/templates/etc/promtail/base.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cookbooks/promtail/templates/etc/promtail/base.yaml b/cookbooks/promtail/templates/etc/promtail/base.yaml
index 147ebfe..1be2338 100644
--- a/cookbooks/promtail/templates/etc/promtail/base.yaml
+++ b/cookbooks/promtail/templates/etc/promtail/base.yaml
@@ -163,7 +163,7 @@ scrape_configs:
 
     pipeline_stages:
     - match:
-        selector: '{job="fail2ban"}'
+        selector: '{job="fail2ban"} !~ "already banned"'
         stages:
         - regex:
             expression: '^(?P<timestamp>[0-9]+\-[0-9]+\-[0-9]+ [0-9]+:[0-9]+:[0-9]+),[0-9]+ [^:]+: (?P<level>[^ ]+)[^\[]+(?P<message>.+)$'