Filters perform log routing inside syslog-ng. You can write a boolean expression using internal functions, which has to evaluate to true for the message to pass.
Filters have also a uniquely identifying name, so you can refer to filters in your log statements. Syntax for the filter statement:
| 	  filter <identifier> { expression; };
	 | 
Example 2-2. A filter statement finding the messages containing the word deny coming from the host blurp
| 	  filter f_blurp_deny { host("blurp") and match("deny"); };
	 | 
Table 2-3. Available filter functions in syslog-ng
| Function | Description | 
|---|---|
| facility() | Selects messages based on their facility code | 
| level() or priority() | Selects messages based on their priority | 
| program() | Tries to match a regular expression to the program name field of log messages | 
| host() | Tries to match a regular expression to the hostname field of log messages | 
| match() | Tries to match a regular expression to the message itself. | 
For a complete description on the above functions, see the Reference chapter.