We are testing the Lookup Table Decorator with no luck,
In the previous Graylog versions, we used this functionality without any problem, but in Graylog 3.2.4, we can’t see the Decorator fields anywhere (Search, Dashboard, etc).
We made a Lookup Table Decorator (the Lookup Table is a DNS Resolution one), to obtain the domain for an IP (SourceIP/DestinationIP -> Decorated SourceHostName/DestinationHostName):
We even tried to set a test string to SourceHostName/DestinationHostName in the Lookup Table if the resolved domain is null, to try if the field appear.
I’m already tried to add the field in a table. In fact, is the second screenshot of my post. I can’t see the decorator fields anywere. I already used decorator fields in old versions of Graylog without any problem, but I can’t see the decorator fields in any place in this version after I configured them.
But I have additional questions, or maybe there are a few bugs in the interface:
Even I selected the Stream for which I created the Decorators in the Search tab, I can’t see them when I edit the Table view, I need to create them again (you can see in the third screenshot that the names of the target fields that I created "on the fly"is slightly different, SourceHostName VS SourceHostname, for example) :
The only way that I can add a decorated field as a Column is using contextual menu in the decorated field, not in the Edit Table dialog (In old versions of Graylog we can add the decorated field as any other field after we create them):
no worry - if that worked different before - means you had been able to select the decorator to be displayed in the table few - this is not possible current.
You might want to create a feature request for that over at github:
