Hi
You need the lookup feature of graylog.
First you need to config lookup, after set an extractor or pipeline to use it.
http://docs.graylog.org/en/2.4/pages/lookuptables.html
https://community.graylog.org/t/using-a-csv-lookup-table-within-a-pipeline/3707
//Decorators are only available in search and work in real time, so you can’t use it in alert and dashboard