Recently (2024-07) I had exactly the same issue as the one described in this reddit post: https://www.reddit.com/r/voidlinux/comments/cj76vm/fail2ban_with_socklog/
That is, I had issues with getting fail2ban to ingest logfile /var/log/socklog/secure/current for sshd jail.
The issue is socklog(?) prefixes the entry with UTC timestamp like so:
2024-06-27T19:21:09.48767 auth.info: Jun 27 21:21:09 sshd[3518]: Unable to negotiate with 218.92.0.59 port 25784: no matching key exchange method found. Their offer: ...
Mind that there is a datae BEFORE auth.info and that date is UTC vs local time that is AFTER.