nginx-log4j-main.conf

# setup /etc/fail2ban/filter.d/nginx-log4j-main.conf
# fail2ban-regex "/var/log/nginx/localhost.access.log" /etc/fail2ban/filter.d/nginx-log4j-main.conf --print-all-matched

[Definition]
failregex = ^<HOST> .*"(GET|HEAD|POST|PUT|PATCH|DELETE|.*).*\$?\{?jndi:(ldap[s]?|rmi|dns|iiop|corba|nds|http|\$\{lower).*
            ^<HOST> .*"(GET|HEAD|POST|PUT|PATCH|DELETE|.*).*\$?\{?((lower|upper):j(ndi)?|{::-j}|{::-n}|{::-d}|{::-i}|{(lower|upper):(rmi|n|d|i|ı)}|env:ENV_NAME|env:TEST:|env:BARFOO:-j|7(b|B)j|base64:JHtqbmRp|\/Basic\/Command\/Base64\/).*
            ^<HOST> .*"(GET|HEAD|POST|PUT|PATCH|DELETE|.*).*(\$\{[^\}]*\$\{|\$\{jndi)