I am start writing many stream for alerts. Usually, a stream is a combination of many rules. Is there any performance difference between by using mutliple rules and regular expression for matching mutliple conditions .
for example: if i want to create a stream for matching the message with string “XXX” or “YYY”. creating of 2 rules for match each string or creating 1 rule only and use regular expression to match these 2 strings?