regex fail2ban joomla 3.5 plesk 12.5

Hello,

I have a problem about writing a regex expression for Fail2Ban
I want to protect administrator access a joomla 3.5
The logs give me the following:
[Mon Jun 06 12: 33: 02.268536 2016 ] [ fcgid : warn] [ pid 3700 ] [ 217.128.126.234:43428 client] mod_fcgid : stderr : JCoulot user authentication failure , referer : http://xxxxxxxxx.com/administrator /
and I created a conf file ( joomla-error.conf ) in etc / fail2ban / filter.d /...

regex fail2ban joomla 3.5 plesk 12.5