Configure it :

SPAM_REGEX                         YES
REGEX_FILE                         ze-regex
REGEX_MAX_SCORE                    50
SPAM_REGEX_MAX_MSG_SIZE            40000
SPAM_REGEX_MAX_MIME_SIZE           15000
DUMP_FOUND_REGEX                   YES
REGEX_LOG_FILE                     file:ze-regex

SPAM_REGEX_MAX_* controls the maximum size of mails to process as soon as spams emails are often less than 40K.

To get more information on actions, have a look here

Edit /etc/ze-filter/ze-regex. The syntax is explain in the default file in commentary.

For example, to reject well known words in Subject: field, add the line :

SUBJECT    1000 (c+(1|l|i)+(a|4)+(1|l|i)+s+|v+(1|l|i)+(a|4)+g+r+(a|4)+)

After modifying ze-regex file, say it to ze-filter :

$ ze-ndc RELOAD TABLES

cf. jndc documentation.

Filtering bodies (for examples with the same words as infra) is really fast as far as I can see on my mailhost. I use more complex expressions and ze-filter doesn't overload mailhost as milter-regex does.