[syslog-ng] filter after source or indifferent?