That works, he forgot the filter line in the github repo
filter.d/pbs-web-aut.conf
[INCLUDES]
before = common.conf
[Definition]
__suffix_failed_login = (AUTH_ERR|invalid credentials|user account disabled or expired).?
failregex = authentication failure; rhost=\[<HOST>\]:\d+ user=.*...