Fail2ban make a custom fail regex filter for Nginx error log

I am new to regex. How do I write a Fail2Ban filter to match with these nxinx error log lines?

2022/11/30 00:46:19 [crit] 57811#57811: *8911 SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client: 64.62.197.168, server: 0.0.0.0:443

and:

2022/11/30 02:26:52 [error] 57811#57811: *8939 upstream timed out (110: Connection timed out) while SSL handshaking to upstream, client: 77.88.5.11, server: xxxxxxxxx.com, request: "GET /robots.txt HTTP/1.1", upstream: "https://0.0.0.0:5000/robots.txt", host: "xxxxxxxxx.com"

The current filter does not catch any of these lines when I use fail2ban-regex to test:

Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [21] {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day[T ]24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
`-

Lines: 21 lines, 0 ignored, 0 matched, 21 missed
[processed in 0.00 sec]

|- Missed line(s):
|  2022/11/30 00:46:19 [crit] 57811#57811: *8911 SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client: 64.62.197.168, server: 0.0.0.0:443
|  2022/11/30 02:26:52 [error] 57811#57811: *8939 upstream timed out (110: Connection timed out) while SSL handshaking to upstream, client: 77.88.5.11, server: xxxxxxxxx.com, request: "GET /robots.txt HTTP/1.1", upstream: "https://0.0.0.0:5000/robots.txt", host: "xxxxxxxxx.com"
|  2022/11/30 02:27:53 [error] 57811#57811: *8942 upstream timed out (110: Connection timed out) while SSL handshaking to upstream, client: 93.158.161.40, server: xxxxxxxxx.com, request: "GET /robots.txt HTTP/1.1", upstream: "https://0.0.0.0:5000/robots.txt", host: "xxxxxxxxx.com"
|  2022/11/30 02:29:53 [error] 57811#57811: *8946 upstream timed out (110: Connection timed out) while SSL handshaking to upstream, client: 77.88.5.133, server: xxxxxxxxx.com, request: "GET / HTTP/1.1", upstream: "https://0.0.0.0:5000/", host: "xxxxxxxxx.com"```

(I replaced my domain name with xxxxxxxxx in the above output)

Thanks!