diff --git a/cmd/circolog-tail/main.go b/cmd/circolog-tail/main.go
index ce653a7..efed1e4 100644
--- a/cmd/circolog-tail/main.go
+++ b/cmd/circolog-tail/main.go
@@ -12,17 +12,30 @@ import (
 	"time"
 
 	"git.lattuga.net/boyska/circolog/formatter"
+	"github.com/araddon/qlbridge/datasource"
+	"github.com/araddon/qlbridge/expr"
+	"github.com/araddon/qlbridge/value"
+	"github.com/araddon/qlbridge/vm"
 	"github.com/gorilla/websocket"
 	"gopkg.in/mcuadros/go-syslog.v2/format"
 	"gopkg.in/mgo.v2/bson"
 )
 
+// TODO: type ExpressionValue
+
 func main() {
 	addr := flag.String("addr", "localhost:9080", "http service address")
 	querySocket := flag.String("socket", "", "Path to a unix domain socket for the HTTP server")
 	backlogLimit := flag.Int("n", -1, "Limit the backlog length, defaults to no limit (-1)")
+	filter := flag.String("where", "", "sql-like query to filter logs")
 	flag.Parse()
 
+	filterExpr, err := expr.ParseExpression(*filter)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "invalid filter:", err)
+		os.Exit(2)
+	}
+
 	interrupt := make(chan os.Signal, 1)
 	signal.Notify(interrupt, os.Interrupt)
 	var d *websocket.Dialer
@@ -69,7 +82,19 @@ func main() {
 			}
 			var parsed format.LogParts
 			if err := bson.Unmarshal(serialized, &parsed); err != nil {
-				log.Println("invalid YAML", err)
+				log.Println("invalid BSON", err)
+				continue
+			}
+			context := datasource.NewContextSimpleNative(parsed)
+			val, ok := vm.Eval(context, filterExpr)
+			if !ok || val == nil { // errors when evaluating
+				continue
+			}
+			if val.Type() != value.BoolType {
+				fmt.Fprintln(os.Stderr, "WARNING: The expression doesn't return a boolean")
+				continue
+			}
+			if val.Value().(bool) != true {
 				continue
 			}
 			if err := formatter.WriteFormatted(os.Stdout, formatter.FormatSyslog, parsed); err != nil {