diff --git a/config/filter.d/dropbear.conf b/config/filter.d/dropbear.conf
index b48615e6..6f34c1ba 100644
--- a/config/filter.d/dropbear.conf
+++ b/config/filter.d/dropbear.conf
@@ -29,7 +29,7 @@ _daemon = dropbear
 #
 failregex = ^%(__prefix_line)s(L|l)ogin attempt for nonexistent user ('.*' )?from <HOST>:.*\s*$
             ^%(__prefix_line)s(B|b)ad password attempt for .+ from <HOST>:.*\s*$
-	     ^%(__prefix_line)sExit before auth \(user .+, \d+ fails\): Max auth tries reached - user .+ from <HOST>:.*\s*$
+            ^%(__prefix_line)sExit before auth \(user .+, \d+ fails\): Max auth tries reached - user .+ from <HOST>:.*\s*$
 
 # The only line we need to match with the modified dropbear.