Thanks Jochen, that looks exactly like what I need. Unfortunately I cannot save that rule, have to figure this one out now:
Could not save processing rule "" > Saving rule "" failed with status: cannot POST > http://mydomain.tld:12900/plugins/org.graylog.plugins.pipelineprocessor/system/pipelines/rule > > (500) -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/234a117a-6dca-449b-a982-5333fc0a810f%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
