diff --git a/filters/ssh.preg b/filters/ssh.preg
index 3305878..388a9a8 100644
--- a/filters/ssh.preg
+++ b/filters/ssh.preg
@@ -15,4 +15,4 @@ Invalid user [[:print:]]+ from <HOST>
 refused connect from [[:print:]]+ \(<HOST>\)
 Did not receive identification string from <HOST>
 Connection closed by <HOST>( port [0-9]+)? \[preauth\]
-Connection closed by authenticating user [[:print:]]+ <HOST> port [0-9]+ [preauth]
+Connection closed by authenticating user [[:print:]]+ <HOST> port [0-9]+ \[preauth\]