[syslog-ng] A question about filtering messages