Which one to choose? Pipeline or Decorators or Logstash translate?

Hi Graylog Team,

I need to use what called Dictionary feature in logstash for looking up a yaml file or CSV file and if match is found add new field in logs.


xyz.com”: “PHISHING”
bad.com”: “APT”
qaz.com”: “CVE-1234-1234”

and so on

Now my confusion is which method should I use to achieve the above stuff? I even need to create a dashboard and Alert notifications basis on those fields and decorators what I understood is - can not be used in Dashboards.

Hence can someone please suggest?


You need the lookup feature of graylog.
First you need to config lookup, after set an extractor or pipeline to use it.

//Decorators are only available in search and work in real time, so you can’t use it in alert and dashboard

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.