diff --git a/config/filter.d/nginx-forbidden.conf b/config/filter.d/nginx-forbidden.conf
index 3c54e61e..62d15a41 100644
--- a/config/filter.d/nginx-forbidden.conf
+++ b/config/filter.d/nginx-forbidden.conf
@@ -19,3 +19,7 @@
 [Definition]
 failregex = \[error\] \d+#\d+: \*\d+ access forbidden by rule, client: <HOST>
 ignoreregex =
+
+datepattern = {^LN-BEG}
+
+journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx