I use a more generic regex which works fine for Nextcloud 12 through 18:
[Definition]
# regex for Nextcloud 12 - 18:
failregex = ^.*Login failed: '?.*'? \(Remote IP: '?<HOST>'?\).*$
I am quite confident that this will serve my needs also with future releases of Nextcloud.