Pipeline evaluates strangely

### Problem description

A few stages, combined with rules don't filter like expected:
some messages contain the fields **Extension_Old** && **Extension_New** (yep wrongly typed).

all 'renamed events' needs to be filtered out of the pipeline, however, they end up in the stream... I cannot wrap my head arround this.

after
stage -1

```
rule "is renamed event"
when
has_field("Action") && $message.Action == "Renamed"
then
end
```

Stage 0( three rules):

```
rule "drop temp files"
when
not(
(has_field("Extension_New") && $message.Extension_New == ".tmp") ||
(has_field("Extension_Old") && $message.Extension_Old == ".tmp")
)
then
end
```

second rule:

```
rule "drop eplan files"
when
$message.Extension_New == ".eod" ||
$message.Extension_New == ".eox" ||
$message.Extension_New == ".dwg"

then
drop_message();
end
```

3rd rule:

```
rule "field extension changed"
when
has_field("Extension_Changed") AND
$message.Extension_Changed == "yes"
then
end
```

stage 1 (write to stream)

```
rule "route to crypto changed extension stream"
when
true
then
route_to_stream("Crypto by Heuristics - changed extensions");
end
```

All stages have the `Messages satisfying all rules in this stage, will continue to the next stage.`
### Steps to reproduce the problem
# Recreate the rules above

Add new messages with either **_.tmp**_ in fields **_Extension_Old**_ or **_Extension_New**_.
Those message should be filtered out, but are not...

Is it due to the matching of the strings, I've tried some variations with `contains(to_string($message.Extension_Old))` but this too looks like it isn't working properly

Any ideas?
### Environment
- Graylog Version: Graylog 2.0.0 (2dc6c03) on
- Elasticsearch Version: elasticsearch-2.1.2.deb
- MongoDB Version: -
- Operating System: Ubuntu 14.04
- Browser version: Chrome