diff --git a/roles/epylog/files/merged/weed_local.cf b/roles/epylog/files/merged/weed_local.cf
index 8235ca293e..c1358fcb7d 100644
--- a/roles/epylog/files/merged/weed_local.cf
+++ b/roles/epylog/files/merged/weed_local.cf
@@ -285,22 +285,22 @@ sshd.*: pam_systemd(sshd:session): Failed to create session: No such file or dir
 sshd.*: fatal: Write failed: Connection reset by peer
 sshd.*: pam_succeed_if\(sshd:auth\): requirement.*
 sshd.*: pam_unix\(sshd:auth\): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=.*
-sshd.*: PAM .* more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=.*
+sshd.*: PAM .* more authentication failures\; logname= uid=0 euid=0 tty=ssh ruser= rhost=.*
 sshd.*: pam_unix\(sshd:auth\): check pass; user unknown
-sshd.*: error: maximum authentication attempts exceeded for.*from.*port.*ssh2 [preauth]
-sshd.*: Disconnecting: Too many authentication failures.*
+sshd.*: error\: maximum authentication attempts exceeded for.*from.*port.*ssh2 [preauth]
+sshd.*: Disconnecting\: Too many authentication failures.*
 sshd.*: Disconnected from.*
 sshd.*: Read error from remote host.*
-sshd.*: error: maximum authentication attempts exceeded for.*
+sshd.*: error\: maximum authentication attempts exceeded for.*
 sshd.*: Close session.*user root from 10.5.126.23 port.*id 0
-sshd.*: error: key_read: uudecode.*failed
+sshd.*: error\: key_read: uudecode.*failed
 sshd.*: Connection reset by.*
-sshd.*: error: buffer_get_ret: trying to get more bytes.*
-sshd.*: error: buffer_get_string_ret: buffer_get failed
-sshd.*: error: buffer_get_bignum2_ret: invalid bignum
-sshd.*: error: key_from_blob: can't read rsa key
-sshd.*: error: key_read: key_from_blob
-sshd.*: Close session: user root from 10.5.126.23 port.*
+sshd.*: error\: buffer_get_ret\: trying to get more bytes.*
+sshd.*: error\: buffer_get_string_ret\: buffer_get failed
+sshd.*: error\: buffer_get_bignum2_ret\: invalid bignum
+sshd.*: error\: key_from_blob\: can\'t read rsa key
+sshd.*: error\: key_read\: key_from_blob
+sshd.*: Close session\: user root from 10.5.126.23 port.*
 stunnel:.*connected remote.*
 stunnel:.*SSL_read.*
 stunnel:.*Connection reset.*