If I understand your use case correctly than this is not possible in Graylog right now.
It will be possible with the Enterprise Version of Graylog 3.0. And later this functionality will be released
to the open source version as well.
1 Like