[syslog-ng] filter/parse based on certificate attributes?