<!-- Sanitized reference copy. Original comments removed; OAuth domains generalized.
     Logic is otherwise unchanged and includes known review issues.
     Read README.md and the draft Technical Review Notes before use. -->

<decoder name="gitlab-failed-login">
  <prematch>Failed Login: </prematch>
  <regex offset="after_prematch">^username=(\S+) ip=(\S+)</regex>
  <order>dstuser, srcip</order>
</decoder>
