I believe they run in parallel. What would otherwise be the purpose of “stages”?
However, I have no idea how graylog handles conflicts between these rules.
I expected to find the answer at Pipelines — Graylog 2.4.6 documentation, but didn’t.
I guess the fastest way is to run some experiments with the Pipeline simulator ?
Heads up: Pipeline simulator may fail if your rules modify timestamp - details here.