[syslog-ng]how to write efficient filters?

Which is more efficient? filter f_pop_acc { program("pop3") and match("not have pop"); }; filter f_mail { facility(mail); }; log { source(s_sys); filter(f_mail); filter(f_pop_acc); destination(d_pop_acc); or filter f_pop_acc { facility(mail) and program("pop3") and match("not have pop"); }; log { source(s_sys); filter(f_pop_acc); destination(d_pop_acc); Sorry too lazy to look at the code :) -tim