syslog-ng difference between “not message(something)” and “not match(something)”?

Question

What is the difference between these two?:

filter f_avc { not message(something); };

and:

filter f_avc { not match(something); };

it's hard to google for these types of questions :D

Answer 1

From the Documentation (my boldface):

Match a regular expression to the headers and the message itself (i.e., the values returned by the MSGHDR and MSG macros).

Match a regular expression to the text of the log message, excluding the headers (i.e., the value returned by the MSG macros).