RegEx to exclude login probe activity

by Apr 13, 2018

Looking for a way to configure the SQL Server Error Log alert to exclude failed logins for specific login attempts that are probed daily, similar to the following.  We know they'll be coming from a specific IP address, but I am not sure whether it even cares about the second line as it will be triggering on the first line.  If we can't find a way to do this we'll probably just set this alert to informational and monitor it some other way as it is rather annoying to have to snooze numerous probe logins each day.

Warning 4/13/2018 10:31:37 AM Logon Error: 18456, Severity: 14, State: 5.
OK 4/13/2018 10:31:37 AM Logon Login failed for user 'probe'. Reason: Could not find a login matching the name provided. [CLIENT: x.x.x.x]