Attempt at parsing sshd logs - how do I avoid _grokparsefailure in disconnect part?