Decorators are not working - Graylog 3.2.4


We are testing the Lookup Table Decorator with no luck, :cry:

In the previous Graylog versions, we used this functionality without any problem, but in Graylog 3.2.4, we can’t see the Decorator fields anywhere (Search, Dashboard, etc).

We made a Lookup Table Decorator (the Lookup Table is a DNS Resolution one), to obtain the domain for an IP (SourceIP/DestinationIP -> Decorated SourceHostName/DestinationHostName):

But we can’t see the Decorator field on Search:

Are we missing something?

We even tried to set a test string to SourceHostName/DestinationHostName in the Lookup Table if the resolved domain is null, to try if the field appear.

Anybody with the same problem?

Thanks in advance.


he @aguida79

the decorator will make the field visible in the data table only.

Hi @jan,

I’m already tried to add the field in a table. In fact, is the second screenshot of my post. I can’t see the decorator fields anywere. I already used decorator fields in old versions of Graylog without any problem, but I can’t see the decorator fields in any place in this version after I configured them.


He @aguida79

just created this little gif that shows how they are shown and where to configure the decorators.


Thanks jan, with your “recipe” now I can see the decorator field in the Table view:

But I have additional questions, or maybe there are a few bugs in the interface:

  • Even I selected the Stream for which I created the Decorators in the Search tab, I can’t see them when I edit the Table view, I need to create them again (you can see in the third screenshot that the names of the target fields that I created "on the fly"is slightly different, SourceHostName VS SourceHostname, for example) :

  • The Decorators that already created for a Stream only show when I edit a Table after I select the Stream in the Streams tab:

  • The only way that I can add a decorated field as a Column is using contextual menu in the decorated field, not in the Edit Table dialog (In old versions of Graylog we can add the decorated field as any other field after we create them):

Sorry for all the large explanation, and for my english.

Thanks in advance for your help.

he @aguida79

no worry - if that worked different before - means you had been able to select the decorator to be displayed in the table few - this is not possible current.

You might want to create a feature request for that over at github:

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.