diff --git a/cmd/circolog-tail/main.go b/cmd/circolog-tail/main.go
index 1e16e4b..67c7d21 100644
--- a/cmd/circolog-tail/main.go
+++ b/cmd/circolog-tail/main.go
@@ -11,41 +11,18 @@ import (
 	"strconv"
 	"time"
 
+	"git.lattuga.net/boyska/circolog/filtering"
 	"git.lattuga.net/boyska/circolog/formatter"
-	"github.com/araddon/qlbridge/datasource"
-	"github.com/araddon/qlbridge/expr"
-	"github.com/araddon/qlbridge/value"
-	"github.com/araddon/qlbridge/vm"
 	"github.com/gorilla/websocket"
 	"gopkg.in/mcuadros/go-syslog.v2/format"
 	"gopkg.in/mgo.v2/bson"
 )
 
-type ExprValue struct {
-	Node expr.Node
-}
-
-func (e *ExprValue) String() string {
-	if e.Node != nil {
-		return e.Node.String()
-	} else {
-		return "<Empty Expression>"
-	}
-}
-func (e *ExprValue) Set(value string) error {
-	ast, err := expr.ParseExpression(value)
-	if err != nil {
-		return err
-	}
-	e.Node = ast
-	return nil
-}
-
 func main() {
 	addr := flag.String("addr", "localhost:9080", "http service address")
 	querySocket := flag.String("socket", "", "Path to a unix domain socket for the HTTP server")
 	backlogLimit := flag.Int("n", -1, "Limit the backlog length, defaults to no limit (-1)")
-	var filter ExprValue
+	var filter filtering.ExprValue
 	flag.Var(&filter, "where", "sql-like query to filter logs")
 	flag.Parse()
 
@@ -98,19 +75,8 @@ func main() {
 				log.Println("invalid BSON", err)
 				continue
 			}
-			if filter.Node != nil {
-				context := datasource.NewContextSimpleNative(parsed)
-				val, ok := vm.Eval(context, filter.Node)
-				if !ok || val == nil { // errors when evaluating
-					continue
-				}
-				if val.Type() != value.BoolType {
-					fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
-					continue
-				}
-				if val.Value().(bool) != true {
-					continue
-				}
+			if filter.Node != nil && !filter.Validate(parsed) {
+				continue
 			}
 			if err := formatter.WriteFormatted(os.Stdout, formatter.FormatSyslog, parsed); err != nil {
 				log.Println("error printing", err)
diff --git a/filtering/filter.go b/filtering/filter.go
new file mode 100644
index 0000000..471e449
--- /dev/null
+++ b/filtering/filter.go
@@ -0,0 +1,47 @@
+package filtering
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/araddon/qlbridge/datasource"
+	"github.com/araddon/qlbridge/expr"
+	"github.com/araddon/qlbridge/value"
+	"github.com/araddon/qlbridge/vm"
+)
+
+type ExprValue struct {
+	Node expr.Node
+}
+
+func (e *ExprValue) String() string {
+	if e.Node != nil {
+		return e.Node.String()
+	} else {
+		return "<Empty Expression>"
+	}
+}
+func (e *ExprValue) Set(value string) error {
+	ast, err := expr.ParseExpression(value)
+	if err != nil {
+		return err
+	}
+	e.Node = ast
+	return nil
+}
+
+func (e *ExprValue) Validate(line map[string]interface{}) bool {
+	context := datasource.NewContextSimpleNative(line)
+	val, ok := vm.Eval(context, e.Node)
+	if !ok || val == nil { // errors when evaluating
+		return false
+	}
+	if val.Type() != value.BoolType {
+		fmt.Fprintln(os.Stderr, "WARNING: The 'where' expression doesn't return a boolean")
+		return false
+	}
+	if val.Value().(bool) != true {
+		return false
+	}
+	return true
+}