Obvious, but double-check that field facility is really present in the log messages.
Try something other than debug, e.g. set a new field in the message. Does that work?
I made the wrong assumption and thought rules are executed in sequential order within the same stage. I have a previous rule that parse the JSON message received and map it into different fields.
The solution was to create 2 stages. Stage0 will only parse the JSON and Stage1 will do the subsequent tasks I want to perform based onf the facility field.