legacyEventType:core.user_auth.login_failed (-"actor.alternateId":(^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,10}))