Figured it all out with help on github, the rule should look like this:
rule "drop headers cron job"
when
contains(to_string($message.message), "COMMAND=/var/www/bin/header.sh")
then
drop_message();
end
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/99edfbdc-4212-4599-80c4-1ed659b87c22%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
