if $programname startswith 'fail2ban' or ($programname == 'journal' and $msg startswith 'fail2ban') then -PH_FAIL2BAN_LOG_FILE
& stop
