Which one to choose? Pipeline or Decorators or Logstash translate?

Graylog Central (peer support)
1

Hi Graylog Team,

I need to use what called Dictionary feature in logstash for looking up a yaml file or CSV file and if match is found add new field in logs.

E.g.

“xyz.com”: “PHISHING”
“bad.com”: “APT”
“qaz.com”: “CVE-1234-1234”

and so on

Now my confusion is which method should I use to achieve the above stuff? I even need to create a dashboard and Alert notifications basis on those fields and decorators what I understood is - can not be used in Dashboards.

Hence can someone please suggest?

2

Hi

You need the lookup feature of graylog.
First you need to config lookup, after set an extractor or pipeline to use it.
http://docs.graylog.org/en/2.4/pages/lookuptables.html
https://community.graylog.org/t/using-a-csv-lookup-table-within-a-pipeline/3707

//Decorators are only available in search and work in real time, so you can’t use it in alert and dashboard