1. A method for improving performance of a Boolean combination of at least two filters to a data stream, comprising: for a first filter applied to data chunks in the data stream, maintaining a first estimator to determine a performance value for the first filter; for a second filter applied to data chunks in the data stream, maintaining a second estimator to determine a performance value for the second filter, the second filter applied to a data chunk after the first filter; randomly selecting a set of times to apply the second filter to a data chunk when the first filter succeeds; maintaining a third estimator to estimate a performance value of the second filter at the selected set of times given the first filter succeeds; wherein the performance values for the first and second filters are based on a success rate to pass a data chunk and an average time to pass a data chunk; and processing the data stream, including dynamically sorting an order of application of the first and second filters based upon the performance values estimated by the first, second, and third estimators.