i'd use [/ip firewall layer7-protocol] instead of [/ip firewall filter], since it's safer and will not accidentally disturb the filter rules, also the regexp can store more data.