diff --git a/CMakeLists.txt b/CMakeLists.txt
index a4366af0..292b7518 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -33,6 +33,9 @@ add_subdirectory(${SYSDIG_DIR} ${PROJECT_BINARY_DIR}/sysdig)
 set(CURL_BUNDLE_DIR "${sysdig_BINARY_DIR}/curl-prefix/src/curl")
 set(CURL_INCLUDE_DIR "${CURL_BUNDLE_DIR}/include/")
 set(CURL_LIBRARIES "${CURL_BUNDLE_DIR}/lib/.libs/libcurl.a")
+
+set(LUAJIT_INCLUDE_DIR "${sysdig_BINARY_DIR}/luajit-prefix/src/luajit/src")
+
 if(NOT USE_BUNDLED_OPENSSL)
 	set(CURL_SSL_OPTION "")
 else()
diff --git a/userspace/digwatch/CMakeLists.txt b/userspace/digwatch/CMakeLists.txt
index a539a445..aecf149d 100644
--- a/userspace/digwatch/CMakeLists.txt
+++ b/userspace/digwatch/CMakeLists.txt
@@ -1,4 +1,5 @@
 include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libsinsp/third-party/jsoncpp)
+include_directories("${LUAJIT_INCLUDE_DIR}")
 
 if(NOT APPLE)
     include_directories("${CURL_INCLUDE_DIR}")
@@ -8,7 +9,7 @@ endif()
 include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libscap)
 include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libsinsp)
 
-add_executable(digwatch digwatch.cpp)
+add_executable(digwatch rules.cpp digwatch.cpp)
 
 target_link_libraries(digwatch sinsp)
 
diff --git a/userspace/digwatch/digwatch.cpp b/userspace/digwatch/digwatch.cpp
index 41e591c2..06f53676 100644
--- a/userspace/digwatch/digwatch.cpp
+++ b/userspace/digwatch/digwatch.cpp
@@ -8,15 +8,13 @@
 #include <algorithm>
 
 #include <sinsp.h>
-#include "lua_parser.h"
+#include "rules.h"
 #include "digwatch.h"
 #include "utils.h"
 
 #include <unistd.h>
 #include <getopt.h>
 
-lua_parser* g_lua_parser;
-
 static void usage();
 
 //
@@ -127,6 +125,7 @@ int digwatch_init(int argc, char **argv)
 {
 	int result;
 	sinsp* inspector = NULL;
+	digwatch_rules* rules = NULL;
 	int op;
 	uint64_t cnt = -1;
 	sinsp_evt::param_fmt event_buffer_format = sinsp_evt::PF_NORMAL;
@@ -234,9 +233,9 @@ int digwatch_init(int argc, char **argv)
 		//
 		sinsp_evt_formatter formatter(inspector, output_format);
 
-		g_lua_parser = new lua_parser(inspector, user_parser);
+		rules = new digwatch_rules(inspector, user_parser);
 
-		inspector->set_filter(g_lua_parser->m_filter);
+		inspector->set_filter(rules->get_filter());
 		inspector->open("");
 
 		cinfo = do_inspect(inspector,
diff --git a/userspace/digwatch/rules.cpp b/userspace/digwatch/rules.cpp
new file mode 100644
index 00000000..7eea6f19
--- /dev/null
+++ b/userspace/digwatch/rules.cpp
@@ -0,0 +1,45 @@
+#include "rules.h"
+
+extern "C" {
+#include "lua.h"
+#include "lualib.h"
+#include "lauxlib.h"
+}
+
+digwatch_rules::digwatch_rules(sinsp* inspector, string compiler_filename)
+{
+	m_lua_parser = new lua_parser(inspector);
+	m_ls = m_lua_parser->m_ls;
+
+	trim(compiler_filename);
+
+	ifstream is;
+	is.open(compiler_filename);
+	if(!is.is_open())
+	{
+		throw sinsp_exception("can't open file " + compiler_filename);
+	}
+
+	string scriptstr((istreambuf_iterator<char>(is)),
+			 istreambuf_iterator<char>());
+
+	//
+	// Load the compiler script
+	//
+	if(luaL_loadstring(m_ls, scriptstr.c_str()) || lua_pcall(m_ls, 0, 0, 0))
+	{
+		throw sinsp_exception("Failed to load script " +
+			compiler_filename + ": " + lua_tostring(m_ls, -1));
+	}
+}
+
+sinsp_filter* digwatch_rules::get_filter()
+{
+	return m_lua_parser->get_filter();
+}
+
+digwatch_rules::~digwatch_rules()
+{
+	delete m_lua_parser;
+}
+
diff --git a/userspace/digwatch/rules.h b/userspace/digwatch/rules.h
new file mode 100644
index 00000000..471a1490
--- /dev/null
+++ b/userspace/digwatch/rules.h
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "sinsp.h"
+#include "lua_parser.h"
+
+class digwatch_rules
+{
+ public:
+	digwatch_rules(sinsp* inspector, string compiler_filename);
+	~digwatch_rules();
+	void load(string rules_filename);
+	sinsp_filter* get_filter();
+
+ private:
+	lua_parser* m_lua_parser;
+	lua_State* m_ls;
+};