The filter package provides two simple classes/interfaces to construct filters: the AuditEventMatch interface and the AuditEventFilter class.
The AuditEventMatch interface encapsulates and atomic checker-component for checking
a particular property of an event. Matches can range from simple property matches, e.g.
comparing the Host
header, to more sophisticated things like event-id lists.
The filter class usually combines several matches into one "filter rule" and is uses these matches to do the filtering. An event usually matches a filter instance, if all matches are fulfilled.