1. A method for classification, comprising: extracting, in a decision logic pipeline, respective classification keys from a collection of data items, each classification key comprising a string of bits; receiving a corpus of rules for matching to the classification keys, each rule comprising a respective set of unmasked bits having corresponding bit values, and at least some of the rules comprising masked bits in addition to the unmasked bits; extracting rule patterns from the corpus, each rule pattern defining a different, respective sequence of masked and unmasked bits to which one or more of the rules conforms; defining in a random access memory (RAM) multiple hash tables, wherein each hash table corresponds to a respective rule pattern and used for searching among the rules conforming to that rule pattern for a rule that matches a given classification key, and wherein a match result of a given rule in a given hash table is also indicative of which of the other hash tables are to be used for subsequent searching of rules that match the given classification key; and classifying the data items by matching the respective classification keys to the rules using one or more of the hash tables.