Many different scripts exist to parse the log output of sshd and attempt to block sources of excessive failed login attempts.  Most such scripts involve fragile, easily-misled text parsing.

Please consider adding a standard hook, configurable in sshd_config, invoked by sshd when a login fails.  That hook should receive the source IP address for the connection, and the login type(s) attempted and failed (not those not attempted), so that it can decide (for instance) to have different thresholds for password attempts/failures and key-based failures.