working extractor ordering. Graylog2/graylog2-web-interface#726