Re-classifying messages

In an environment where stuff changes a lot it could be very beneficial to have the ability to re-classify messages.

One very real example is adding devices that already have existing messages in ES to a stream. Another could be the merger of 2 separate streams. A third possibility is the ability to re-run messages through an recently added extractor.

I feel that this is a necessity for providing credibility and robustness to stream based analyses, reporting and alerting (since streams are such a vital anchor point for the way Graylog2 works).

The notion of long running system jobs already exists in Graylog2 - this would make a nice addon.

I am aware of complications, limitations, impacts, bla bla, because of the way ES works but this is rather essential because coherency and correctness are an absolute must for critical environments.

A fair compromise could be to expose this as an opt-in feature that requires clicking through 50 "I know I am stupid but I really want to do this anyways and nobody else but me is to blame" buttons and not doing this automagically upon events such as adding or modifying extractors).