Hello && welcome @GrAlog_learner
Hope you don’t mind but I moved this post to Graylog Central (i.e., This is for help) the other category templates-and-rules-exchange is for members sharing Templates that they have created.
As for your question you could use a pipeline here
OR
You can look here for examples.
OR
Perhaps this here
Hope that helps