Decorator on stream

Graylog Central (peer support)
1

Here is my use case, I created decorator with few combined fields, then saved that search, then got the decorator filed like

&fields=appname%2Cendtime%2CInput_App_Name%2CInput_App_Size%2Cjob_date%2COutput_App_Name%2COutput_App_Size%2Crun_duration%2Cstatus&relative=300

Then created stream and alert, in e mail alert notification appended the above string along with stream URL, like

${if stream_url}Stream URL: ${stream_url}&fields=appname%2Cendtime%2CInput_App_Name%2CInput_App_Size%2Cjob_date%2COutput_App_Name%2COutput_App_Size%2Crun_duration%2Cstatus&relative=300

After getting the email, click on the stream URL,

https://xxx.xxx.Xxx.165:9000/streams/58b3b4111792147c7cb50cf1/messages?rangetype=absolute&from=2017-03-03T22:39:34.006Z&to=2017-03-03T22:41:34.006Z&q=*&fields=appname%2Cendtime%2CInput_App_Name%2CInput_App_Size%2Cjob_date%2COutput_App_Name%2COutput_App_Size%2Crun_duration%2Cstatus&relative=300

You cant see the decorated field values, looks like decorator cannot apply on the indexed stream and it only work with search result, is it true ? what is the real reason we are unable to support on the indexed result ?

2

Hey Rayees,

have you added the decorator to the stream you are linking to as well? The decorator configuration is persisted per stream, so when you link to the other stream from the alerting mail, the decorated fields simply do not exist because the decorator is not run for that stream.

3

Is there any plan to support decorator in global level ???

4

Since the “global level” is a stream now too, you can use decorators for the default stream as well.