startup time vs per-log items

[davidelang]

trafficstars

would it be useful to tag/organize the docs to make it clear what things are processed at startup time vs what is processed per log message?

I've seen so many bad configs that act like templates definitions are evaluated for each message and people puzzled by that.

I think making this dichotomy clear would help reduce confusion.