Complex search query

With message centralization we have a lot of application ( postfix,OpenLDAP for example) that logs messages on multiple line at different time.

for example postfix log. This is a complete mail log process

Dec 17 09:27:45 smtp1 postfix/smtpd[27966]: A86FAA54: client=xxxx[xxx.xxx.xxx.xxx]
Dec 17 09:27:45 smtp1 postfix/cleanup[27980]: A86FAA54: message-id=
Dec 17 09:27:45 smtp1 postfix/qmgr[52181]: A86FAA54: from=bar@foo, size=725, nrcpt=1 (queue active)
Dec 17 09:27:45 smtp1 postfix/smtpd[27966]: disconnect from xxxx[xxx.xxx.xxx.xxx]
Dec 17 09:27:45 smtp1 postfix/smtp[27674]: A86FAA54: to=foor@bar, relay=xxxxxx[xxx.xxx.xxx.xxx]:25, delay=0.08, delays=0.02/0/0.01/0.04, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as B0D5110DD45)
Dec 17 09:27:45 smtp1 postfix/qmgr[52181]: A86FAA54: removed

Some time user ask for

Send all email from bar@foo and their destination.

Actually we can't doing this with graylog2. They are no iteration into search bar.

I think some thing of

for ( from:bar@foo ) {
search ( qid:$qid) wheere _exists_:to
}