since you are on that

```
Adding Filters
--------------------

If you add a filters.d/*.conf file also add a file with the matching * name under testcases/files/logs/
```
If you are up for it -- you could even finally (I never made to it) formalize description of those tests (see sshd example file) -- so we could add a unittest which would go through all those filters/example files and verifies that filters still catch what they should etc