Just to be more precise, there need to be a space after the text in prefix=, so "PREFIX-SSH-PORT ". In iptables this should result in "... --log-prefix "PREFIX-SSH-PORT " ...; note the space after PORT. Otherwise elements in the text in the syslog are not separated by spaces. You may need to use the newest version of firewalld-cmd for this to work this way. See issue #481 in firewalld on github.