flogtool tail/dump need event filters

I've been thinking that a way to provide arbitrary python expressions would be useful:

flogtool tail --filter "e.level > DEBUG and 'oops' in e.msg and b2a(e.SI).startswith('abcd')"

The idea would be that each event is turned into an instance, then a special environment (namespace) is set up with convenience functions. Then the filter expression is evaluated in that namespace, and if it evals to True, the message is printed.

One stumbling point for me has been to figure out how to safely provide the same functionality to a web-viewer. You can't allow browsers to paste expressions: that would be a huge security hole. But, it just occured to me that you could start a web-viewer process in the background, then use a foolscap tool to send named expressions to it over a secure connection (i.e. have a FURL for the viewer). These expressions would then appear in the web-viewer as toggles: enable filter 1, disable filter 2, etc. The browser could use pre-existing filters (provided through the secure path), but couldn't create new ones of its own.