[syslog-ng]A few questions

Hello, I have been messing with syslog-ng for awhile now. and I have it working on a central log server that I am working on, and now I have a few questions. 1. Is it better to do the filtering on the remote log server or the syslog server? I would think sending all logs to the syslog server would create uneeded traffic. 2. I am logging using the following variables, but it seems that the log is only getting logged as message_$date in the dir. Why is this? /$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH_$DAY" TIA, Keith Olmstead