I wonder
1. could not journalmatch become a single regexp avoiding need for two different specifications? 
    e.g. _(SYSTEMD_UNIT=sshd.service|COMM=sshd) ?
2. shouldn't journalmatch be actually specified in the correspoding filter.d/ file instead of a jail definition?