The default order is an unfortunate oversight. It is ordered alphabetically (with the full class name)
For a long time we didn’t dare to change the default, because it will break the processing
of existing setups.
The next release will have the order fixed. (But only for new installations)
See Define a new improved default message processing order by mpfz0r · Pull Request #13081 · Graylog2/graylog2-server · GitHub
for details.
Also of Note: The stream rules are become a separate message processor: