Hello osquery gurus 😀 How I would add logged into username or not in each schedule query? I tried to use decorator queries before each query in the schedule queries. But when I logged out my machine, it's still appending before logged-in information. Please let me know, how do I fix it?

{
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "schedule_splay_percent": "10",
    "worker_threads": 8,
    "host_identifier": "hostname"
  },
  "schedule": {
    "processes_events": {
      "query": "SELECT pe.pid, pe.path, pe.mode, pe.cmdline, pe.uid, pe.owner_uid, pe.atime, pe.mtime, pe.ctime, pe.parent, pe.time, u.username, u.shell, ps.name AS ppid_name, ps.path AS ppid_path, ps.cmdline AS ppid_cmdline, ps.cwd AS ppid_cwd FROM process_events pe JOIN users u ON pe.uid = u.uid JOIN processes ps ON ps.pid = pe.parent WHERE pe.path LIKE '/usr/sbin/%';",
      "interval": 10,
      "removed": false,
      "description": "Collect data about all running processes via process auditing"
    }
  },
  "decorators": {
    "load": [
      "SELECT name || ' ' ||+version AS osname from os_version;"
    ],
    "always": [
      "SELECT liu.user, liu.tty, liu.host, liu.time, liu.pid, p.name, p.cmdline FROM logged_in_users liu, processes p WHERE liu.type='user' AND liu.pid = p.pid;"
    ]
  },
  "packs": {
    "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf"
  }
}

If I logged in my machine using ssh

{
  "name": "processes_events",
  "hostIdentifier": "www1",
  "calendarTime": "Tue Aug  1 12:52:42 2017 UTC",
  "unixTime": "1501591962",
  "epoch": "0",
  "decorations": {
    "cmdline": "sshd: james [priv]",
    "host": "192.168.100.200",
    "name": "sshd",
    "pid": "24997",
    "time": "1501591665",
    "tty": "pts/1",
    "user": "james",
    "osname": "Red Hat Enterprise Linux Server release 6.6 (Santiago)"
  },
  "columns": {
    "atime": "1409142079",
    "cmdline": "/usr/sbin/sshd -R",
    "ctime": "1433201916",
    "mode": "33261",
    "mtime": "1409142079",
    "owner_uid": "0",
    "parent": "86217",
    "path": "/usr/sbin/sshd",
    "pid": "27617",
    "ppid_cmdline": "/usr/sbin/sshd",
    "ppid_cwd": "/",
    "ppid_name": "sshd",
    "ppid_path": "/usr/sbin/sshd",
    "shell": "/bin/bash",
    "time": "1501591959",
    "uid": "0",
    "username": "root"
  },
  "action": "added"
}

When I logged out my machine, decorator are still appended to each log line despite all logged out.

{
  "name": "processes_events",
  "hostIdentifier": "www1",
  "calendarTime": "Tue Aug  1 12:55:31 2017 UTC",
  "unixTime": "1501592131",
  "epoch": "0",
  "decorations": {
    "cmdline": "sshd: james [priv]",
    "host": "192.168.100.200",
    "name": "sshd",
    "pid": "24997",
    "time": "1501591665",
    "tty": "pts/1",
    "user": "james",
    "osname": "Red Hat Enterprise Linux Server release 6.6 (Santiago)"
  },
  "columns": {
    "atime": "1500531725",
    "cmdline": "/usr/sbin/zdump -v",
    "ctime": "1433201916",
    "mode": "33261",
    "mtime": "1409142079",
    "owner_uid": "0",
    "parent": "134388",
    "path": "/usr/sbin/zdump",
    "pid": "29439",
    "ppid_cmdline": "/usr/sbin/zdump",
    "ppid_cwd": "/",
    "ppid_name": "zdump",
    "ppid_path": "/usr/sbin/zdump",
    "shell": "/bin/bash",
    "time": "1501592129",
    "uid": "0",
    "username": "root"
  },
  "action": "added"
}

I wanna below when I logged out.

{
  "name": "processes_events",
  "hostIdentifier": "www1",
  "calendarTime": "Tue Aug  1 12:55:31 2017 UTC",
  "unixTime": "1501592131",
  "epoch": "0",
  "decorations": {
    "cmdline": "",
    "host": "",
    "name": "",
    "pid": "",
    "time": "",
    "tty": "",
    "user": "",
    "osname": "Red Hat Enterprise Linux Server release 6.6 (Santiago)"
  },
  "columns": {
    "atime": "1500531725",
    "cmdline": "/usr/sbin/zdump -v",
    "ctime": "1433201916",
    "mode": "33261",
    "mtime": "1409142079",
    "owner_uid": "0",
    "parent": "134388",
    "path": "/usr/sbin/zdump",
    "pid": "29439",
    "ppid_cmdline": "/usr/sbin/zdump",
    "ppid_cwd": "/",
    "ppid_name": "zdump",
    "ppid_path": "/usr/sbin/zdump",
    "shell": "/bin/bash",
    "time": "1501592129",
    "uid": "0",
    "username": "root"
  },
  "action": "added"
}