[syslog-ng]how to write efficient filters?

[Timothy Webster]

Which is more efficient?

filter f_pop_acc     { program("pop3") and match("not have pop"); };
filter f_mail        { facility(mail); };

log { source(s_sys); filter(f_mail); filter(f_pop_acc); destination(d_pop_acc); 


or

filter f_pop_acc     { facility(mail) and program("pop3") and match("not have pop"); };
log { source(s_sys); filter(f_pop_acc); destination(d_pop_acc); 

Sorry too lazy to look at the code :)

-tim