Just to be more precise, there need to be a space after the text in prefix=, so
"PREFIX-SSH-PORT ". In iptables this should result in "... --log-prefix
"PREFIX-SSH-PORT " ...; note the space after PORT. Otherwise elements in the
text in the syslog are not separated by spaces.
You may need to use the newest version of firewalld-cmd for this to work this way. See
issue #481 in firewalld on github.