# Which one to choose? Pipeline or Decorators or Logstash translate?

**URL:** <https://community.graylog.org/t/which-one-to-choose-pipeline-or-decorators-or-logstash-translate/6887>\
**Category:** Graylog Central (peer support)\
**Created:** [September 19, 2018, 7:44am UTC](https://community.graylog.org/t/which-one-to-choose-pipeline-or-decorators-or-logstash-translate/6887 "2018-09-19T07:44:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [September 19, 2018, 7:44am UTC](https://community.graylog.org/t/which-one-to-choose-pipeline-or-decorators-or-logstash-translate/6887/1 "2018-09-19T07:44:54Z")

</div>

Hi Graylog Team,

I need to use what called Dictionary feature in logstash for looking up a yaml file or CSV file and if match is found add new field in logs.

E.g.

“[xyz.com](http://xyz.com)”: “PHISHING”  
“[bad.com](http://bad.com)”: “APT”  
“[qaz.com](http://qaz.com)”: “CVE-1234-1234”

and so on

Now my confusion is which method should I use to achieve the above stuff? I even need to create a dashboard and Alert notifications basis on those fields and decorators what I understood is - can not be used in Dashboards.

Hence can someone please suggest?

---

<div class="post-metadata">

**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\
**Post date:** [September 19, 2018, 8:52am UTC](https://community.graylog.org/t/which-one-to-choose-pipeline-or-decorators-or-logstash-translate/6887/2 "2018-09-19T08:52:43Z")

</div>

Hi

You need the lookup feature of graylog.  
First you need to config lookup, after set an extractor or pipeline to use it.  
[http://docs.graylog.org/en/2.4/pages/lookuptables.html](http://docs.graylog.org/en/2.4/pages/lookuptables.html)  
[https://community.graylog.org/t/using-a-csv-lookup-table-within-a-pipeline/3707](https://community.graylog.org/t/using-a-csv-lookup-table-within-a-pipeline/3707)

//Decorators are only available in search and work in real time, so you can’t use it in alert and dashboard

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 3, 2018, 8:52am UTC](https://community.graylog.org/t/which-one-to-choose-pipeline-or-decorators-or-logstash-translate/6887/3 "2018-10-03T08:52:47Z")

</div>

Closed on October 3, 2018, 8:52am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.