qmail log pattern needed please please

Hi,
I amd not very good at this and after many attempts, in which i made things worse and worse... i throw myself on the mercy of anyone helpful :)

i am using plesk with qm,ail which has horrible logging.. for smtp auth attampts it logs as

Sep 14 15:14:13 servermasters smtp_auth: smtp_auth: FAILED: lizdy - password incorrect from (null)@control.newcastleone.net [88.208.228.107]
Sep 14 15:14:13 servermasters smtp_auth: SMTP connect from (null)@control.newcastleone.net [88.208.228.107]

i tried the below as my best attempt,

"smtp_auth":
r'{LOG_PREFIX{smtp_auth}} password incorrect .*\"{HOST_IP}"$',

but after putting that in, blockhosts seemed to be happily running, but stopped adding ips to hosts allow...

any help gratefully accepted
cheers

here's the pattern

    "qmail-Fail":
        r'{LOG_PREFIX{smtp_auth}} smtp_auth: FAILED: .* password incorrect from .* \[{HOST_IP}]$',