diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index f3dd29f8..8e9c22e2 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -14,7 +14,8 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = (?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid))? user .*(?: from|FROM) <HOST>
+failregex = Authentication failure for .* from <HOST>
+            Failed [-/\w+]+ for .* from <HOST>
             ROOT LOGIN REFUSED .* FROM <HOST>
             [iI](?:llegal|nvalid) user .* from <HOST>