[syslog-ng] Quick filter question again