/etc/fail2ban/filter.d/jail.local:

[owncloud]
enabled = true
filter  = owncloud
port    = https
logpath = /var/www/owncloud/data/owncloud.log

/etc/fail2ban/filter.d/owncloud.conf:

[Definition]
failregex={"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>', X-Forwarded-For: '.*'\)","level":2,"time":".*"}

ignoreregex =

/var/www/owncloud/data/owncloud.log:

{"reqId":"824ff389f8cbbe1a38a56df1bf08e0d7","remoteAddr":"192.168.0.1","app":"core","message":"Login failed: 'test' (Remote IP: '192.168.0.1', X-Forwarded-For: '')","level":2,"time":"2015-05-23T19:09:50+00:00"}

fail2ban-regex /var/www/owncloud/data/owncloud.log /etc/fail2ban/filter.d/owncloud.conf -v:

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/owncloud.conf
Use         log file : /var/www/owncloud/data/owncloud.log


Results
=======

Failregex: 28 total
|-  #) [# of hits] regular expression
|   1) [28] {"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>', X-Forwarded-For: '.*'\)","level":2,"time":".*"}
|      192.168.0.1  Sat May 23 20:09:50 2015
|      192.168.0.1  Sat May 23 20:30:31 2015
|      192.168.0.1  Sat May 23 20:30:33 2015
|      192.168.0.1  Sat May 23 20:30:35 2015
|      192.168.0.1  Sat May 23 20:30:37 2015
|      192.168.0.1  Sat May 23 20:30:39 2015
|      192.168.0.1  Sat May 23 20:42:20 2015
|      192.168.0.1  Sat May 23 20:42:22 2015
|      192.168.0.1  Sat May 23 20:42:24 2015
|      192.168.0.1  Sat May 23 20:42:26 2015
|      192.168.0.1  Sat May 23 20:42:28 2015
|      192.168.0.1  Sat May 23 20:42:31 2015
|      192.168.0.1  Sat May 23 20:42:32 2015
|      192.168.0.1  Sat May 23 20:42:35 2015
|      192.168.0.1  Sun May 24 00:13:26 2015
|      192.168.0.1  Sun May 24 00:13:29 2015
|      192.168.0.1  Sun May 24 00:13:31 2015
|      192.168.0.1  Sun May 24 00:13:33 2015
|      192.168.0.1  Sun May 24 00:20:49 2015
|      192.168.0.1  Sun May 24 00:20:51 2015
|      192.168.0.1  Sun May 24 00:20:59 2015
|      192.168.0.1  Sun May 24 00:21:04 2015
|      192.168.0.1  Sun May 24 00:27:52 2015
|      192.168.0.1  Sun May 24 00:27:54 2015
|      192.168.0.1  Sun May 24 00:27:56 2015
|      192.168.0.1  Sun May 24 00:27:58 2015
|      192.168.0.1  Sun May 24 00:28:00 2015
|      192.168.0.1  Sun May 24 00:28:01 2015
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [777] ISO 8601
|  [0] WEEKDAY MONTH Day Hour:Minute:Second[.subsecond] Year
|  [0] WEEKDAY MONTH Day Hour:Minute:Second Year
|  [0] WEEKDAY MONTH Day Hour:Minute:Second
|  [0] MONTH Day Hour:Minute:Second
|  [0] Year/Month/Day Hour:Minute:Second
|  [0] Day/Month/Year Hour:Minute:Second
|  [0] Day/Month/Year2 Hour:Minute:Second
|  [0] Day/MONTH/Year:Hour:Minute:Second
|  [0] Month/Day/Year:Hour:Minute:Second
|  [0] Year-Month-Day Hour:Minute:Second[,subsecond]
|  [0] Year-Month-Day Hour:Minute:Second
|  [0] Year.Month.Day Hour:Minute:Second
|  [0] Day-MONTH-Year Hour:Minute:Second[.Millisecond]
|  [0] Day-Month-Year Hour:Minute:Second
|  [0] Month-Day-Year Hour:Minute:Second[.Millisecond]
|  [0] TAI64N
|  [0] Epoch
|  [0] Hour:Minute:Second
|  [0] <Month/Day/Year@Hour:Minute:Second>
|  [0] YearMonthDay Hour:Minute:Second
|  [0] Month-Day-Year Hour:Minute:Second
`-

Lines: 777 lines, 0 ignored, 28 matched, 749 missed
Missed line(s): too many to print.  Use --print-all-missed to print all 749 lines