fail2ban filter for http 401

caddy.conf

# lives in filter.d/

[Definition]
failregex = ^<HOST> -.* HTTP/[0-9].[0-9]" 401
ignoreregex =

jail.conf

[caddy]
enabled = true
filter = caddy
logpath = /var/log/caddy_access_logs
banTime = 3600
findTime = 600
maxretry = 5

What are you using for your caddyfile config to generate /var/log/caddy_access_logs?

log /var/log/caddy_access_logs {
 rotate_size 30
}

that's what I use - I think that's the old caddy syntax, if you have the new syntax at hand I'd be interested :)

Caddy 2 has deprecated common log format, superseeded by a structured log pipeline.
For now the old standard log format is still accessible via

log {
  output file /var/log/access.log
  format single_field common_log
}