Multiple patterns for matching within socklog?

In socklog, is it possible to make use of patterns in the following way?

  For service "mail", accept all messages which match "mail.*" and which
  do not contain the string "imap".

  For a new service that I call "imap", accept all messages which match
  "mail.*" and which do contain the string "imap".

  In other words, this splits "mail.*" log messages into two groups, one
  with the word "imap" in them, and one without.  Then, each group gets
  logged into separate files.

This seems to require a multiple pattern match, but I don't see how this
can be done. However, perhaps I'm missing something.

Thanks in advance for any suggestions you might have.