````
Mar 29 05:59:23 dusky sshd[20878]: [ID 800047 auth.info] Failed keyboard-interactive for <invalid username> from 205.186.180.29 port 42742 ssh2
Mar 29 05:20:09 dusky sshd[19558]: [ID 800047 auth.info] Failed keyboard-interactive for james from 205.186.180.29 port 54520 ssh2
````

It's the extra ID text:

`[ID 800047 auth.info]`

We could change the line from #175 to:

` ^%(__prefix_line)s.*Failed \S+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?\s*$`

Or add an extra regex shortcut to [common.conf](../blob/master/config/filter.d/common.conf)?

E.g.

````
# extra daemon info
# EXAMPLE: [ID 800047 auth.info]
__daemon_extra_re = (?:\[.*\])
````
then add it to the prefix line
````
# Common line prefixes (beginnings) which could be used in filters
#
#       [hostname] [vserver tag] daemon_id spaces
# this can be optional (for instance if we match named native log files)
__prefix_line = \s*(?:%(__hostname)s )?(?:%(__kernel_prefix)s )?(?:@vserver_\S+ )?%(__daemon_combs_re)s?\s*%(__daemon_extra_re)s?\s*
````
I've tested both with my test lines, need to figure out how to run the full test suite.

Which approach would you prefer?