http_log_module filter by status

[karlseguin]

I was interested in having nginx log 404s to their own file.
Essentially, i _hate_ 404s, so I like to parse access logs find and
report all 404s. However, as-is, parsing large access logs can be quite
inefficient since 404s represent such a small % of the entire file. I
was thinking nginx could filter it out at write-time:

access_log  not_found.log  combined buffer=16K 404;


Apologies for the lameness of the code, but this is what I came up
with:
https://gist.github.com/2906701

I certainly don't recommend anyone uses it, I'm mostly just looking for
feedback. Is this better off in its own module? (there's so much code in
the http_log_module that I want to leverage though). There's much more
filtering that could go on that perhaps a new directive is a better
approach:

access_log_filter $status /(40\d)/
access_log_filter $method GET

(which is certainly beyond my capabilities).

Thoughts?

Posted at Nginx Forum: http://forum.nginx.org/read.php?2,227401,227401#msg-227401