journalctl provides a bunch of different output messsages. This regex is searching for failed or accepted connection strings.
The following groups are defined:
ssh_id**: The connection id.
action**: Can be 'Accepted' or 'Failed'
username**: The username ...
Submitted by Xerath Ahbrosha - 8 years ago