Thanks for the comments:
1. I agree, although the way that filters can be defined in journalctl does not lend it self to regexp. (see examples: [journalctl man page](http://www.freedesktop.org/software/systemd/man/journalctl.html)). I can copy the journalctl implementation e.g. _SYSTEMD_UNIT=sshd.service + COMM=sshd
2. I originally was swapping out logpath which is why I put it here, but I'm indifferent on this to be honest and happy to change it?