--- a/prototype.toml	Sat Dec 03 11:18:58 2016 +0100
+++ b/prototype.toml	Sat Dec 03 14:16:24 2016 +0100
@@ -12,6 +12,7 @@
 addr = "10.0.0.2"
 port = 538
 
+[files]
 [files.messages]
 # All possible options are described here
 
@@ -32,15 +33,37 @@
 compress = "gzip"
 
 # #####################
-# Rules are evaluated in the defined order, but a match doesn't stop evaluation.
+# Rules are evaluated in the defined order.
 # This means that the same message can end up in several destinations.
+# 
+# A pattern consists of one or more filters, separated by ';'.
+# A filter consists of one or more facilities, a dot ('.'), and one or more levels.
+# A facility is kern/user/mail/daemon/auth/syslog/lpr/news/uucp/cron/authpriv/ftp or local0..local7;
+#   multiple facilities are separated by ','.
+# 
+# A level is none/emerg/alert/crit/err/warn/notice/info/debug; multiple levels are separated by ','.
+#   A single level matches all levels that are more important than itself and itself (crit matches crit, alert and emerg).
+#   A single level prefixed by '=' matches only that level ('=crit' matches only crit).
+#
+# The evaluation order inside a pattern is left-to-right; as soon as a filter matches, the pattern matches.
+#
+# If a rule has the stop property set to 'true', then evaluation stops if the pattern matched.
 [[rules]]
-pattern = "*.info,mail.none,auth.none"
-dest = "infolog"
+pattern = "lpr.*"
+# null refers to the special null destination, which sends messages to /dev/null.
+dest = "null"
 
 [[rules]]
-pattern = "mail.*"
+pattern = "mail,news.*"
+# One destination can be referenced in multiple rules.
 dest = "maillog"
+# stop evaluation after this rule. Default is fall-through.
+# i.e., make sure log messages from the mail and news systems ONLY end up in maillog, and nowhere else.
+stop = true
+
+[[rules]]
+pattern = "*.info"
+dest = "infolog"
 
 [[rules]]
 pattern = "*.*"