Hi all, I’m having issues with decorators - I’ve added the following to the agent options in fleet, but none of my results have the decorator fields:

config:
  options:
    pack_delimiter: /
    host_identifier: hostname
    logger_tls_period: 10
    distributed_plugin: tls
    disable_distributed: false
    logger_tls_endpoint: /api/osquery/log
    distributed_interval: 10
    distributed_tls_max_attempts: 3
  decorators:
    always:
      - SELECT uuid AS host_uuid FROM system_info;
      - SELECT hostname AS hostname FROM system_info;
      - SELECT 'testing' AS test_decoration;
overrides:
  platforms:
--- snipped ---

Thanks!

Hey @George! I see that you may have

overrides

set for certain platforms. Are you setting the decorators there as well?

🤦 that’s it - thanks @Kathy Satterlee I was reading

default

to be the default I set in the configuration not the actual default configuration for osquery. Thank you!

I’ll see if I can make that a little clearer in the docs :)

Don’t worry, it’s clear, I’m just an idiot 😉

You’re not the first person to get thrown off by overrides!