<filter> directive:foo.bar, and if the message field's value contains cool, the events go through the rest of the configuration.<match> directive for output plugins, <filter> matches against a tag. Once the event is processed by the filter, the event proceeds through the configuration top-down. Hence, if there are multiple filters for the same tag, they are applied in descending order. Hence, in the following example:message field contain cool get the new field hostname with the machine's hostname as its value.filter method. If the plugin which uses filter_stream exists, chain optimization is disabled.