I just looked in older post and I see it is not possible to re-process Graylog logs
So in my particular case where I already have the logs, adding the pipeline (thanks for the tip, it seems pretty cook) will not help me.
So I somehow need to make my regex work on the messages field.
Any idea much appreciated