Widget Correlation Event

## What?

I need to correlation i.e. of Firewall and WAF(nginx) by Source IP of Messages.
I store all Source IP into srcip field.
I want to correlation of events by srcip | source (FW or WAF) | event | action | count()

I.E:
192.168.1.15 >> Firewall >> WordPress.Injection >> detected >> 15
###########>> WAF ##>> SQL Injection ######>> blocked >> 14
###########>> ######>> ##################>> detected >> 1

192.168.15.3 >> WAF ##>> Cros Script Attack ##>> blocked >> 12
###########>> Firewall >> XSS Attack #######>> blocked >> 10
###########>> #######>> ################>> detected >> 2

I need that in the widget only show srcip that show in at least two sources (FW and WAF) or three sources like Firewall, WAF and Antivirus.

## Why?

I think this feature is really useful to everyone

## Your Environment

* Graylog Version: 3.2.4
* Elasticsearch Version: 6.5.4
* MongoDB Version: 3.6
* Operating System: FreeBSD 11.3 STABLE