Hello osquery gurus 😀 How I would add logged into username or not in each schedule query? I tried to use decorator queries before each query in the schedule queries. But when I logged out my machine, it's still appending before logged-in information. Please let me know, how do I fix it?

{
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "schedule_splay_percent": "10",
    "worker_threads": 8,
    "host_identifier": "hostname"
  },
  "schedule": {
    "processes_events": {
      "query": "SELECT pe.pid, pe.path, pe.mode, pe.cmdline, pe.uid, pe.owner_uid, pe.atime, pe.mtime, pe.ctime, pe.parent, pe.time, u.username, u.shell, ps.name AS ppid_name, ps.path AS ppid_path, ps.cmdline AS ppid_cmdline, ps.cwd AS ppid_cwd FROM process_events pe JOIN users u ON pe.uid = u.uid JOIN processes ps ON ps.pid = pe.parent WHERE pe.path LIKE '/usr/sbin/%';",
      "interval": 10,
      "removed": false,
      "description": "Collect data about all running processes via process auditing"
    }
  },
  "decorators": {
    "load": [
      "SELECT name || ' ' ||+version AS osname from os_version;"
    ],
    "always": [
      "SELECT liu.user, liu.tty, liu.host, liu.time, liu.pid, p.name, p.cmdline FROM logged_in_users liu, processes p WHERE liu.type='user' AND liu.pid = p.pid;"
    ]
  },
  "packs": {
    "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf"
  }
}

If I logged in my machine using ssh {"name":"processes_events","hostIdentifier":"www1","calendarTime":"Tue Aug 1 125242 2017 UTC","unixTime":"1501591962","epoch":"0","decorations":{"cmdline":"sshd: james [priv]","host":"192.168.100.200","name":"sshd","pid":"24997","time":"1501591665","tty":"pts\/1","user":"james","osname":"Red Hat Enterprise Linux Server release 6.6 (Santiago)"},"columns":{"atime":"1409142079","cmdline":"\/usr\/sbin\/sshd -R","ctime":"1433201916","mode":"33261","mtime":"1409142079","owner_uid":"0","parent":"86217","path":"\/usr\/sbin\/sshd","pid":"27617","ppid_cmdline":"\/usr\/sbin\/sshd","ppid_cwd":"\/","ppid_name":"sshd","ppid_path":"\/usr\/sbin\/sshd","shell":"\/bin\/bash","time":"1501591959","uid":"0","username":"root"},"action":"added"} When I logged out my machine, decorator are still appended to each log line despite all logged out. {"name":"processes_events","hostIdentifier":"www1","calendarTime":"Tue Aug 1 125531 2017 UTC","unixTime":"1501592131","epoch":"0","decorations":{"cmdline":"sshd: james [priv]","host":"192.168.100.200","name":"sshd","pid":"24997","time":"1501591665","tty":"pts\/1","user":"james","osname":"Red Hat Enterprise Linux Server release 6.6 (Santiago)"},"columns":{"atime":"1500531725","cmdline":"\/usr\/sbin\/zdump -v","ctime":"1433201916","mode":"33261","mtime":"1409142079","owner_uid":"0","parent":"134388","path":"\/usr\/sbin\/zdump","pid":"29439","ppid_cmdline":"\/usr\/sbin\/zdump","ppid_cwd":"\/","ppid_name":"zdump","ppid_path":"\/usr\/sbin\/zdump","shell":"\/bin\/bash","time":"1501592129","uid":"0","username":"root"},"action":"added"} I wanna below when I logged out. {"name":"processes_events","hostIdentifier":"www1","calendarTime":"Tue Aug 1 125531 2017 UTC","unixTime":"1501592131","epoch":"0","decorations":{"cmdline":"","host":"","name":"","pid":"","time":"","tty":"","user":"","osname":"Red Hat Enterprise Linux Server release 6.6 (Santiago)"},"columns":{"atime":"1500531725","cmdline":"\/usr\/sbin\/zdump -v","ctime":"1433201916","mode":"33261","mtime":"1409142079","owner_uid":"0","parent":"134388","path":"\/usr\/sbin\/zdump","pid":"29439","ppid_cmdline":"\/usr\/sbin\/zdump","ppid_cwd":"\/","ppid_name":"zdump","ppid_path":"\/usr\/sbin\/zdump","shell":"\/bin\/bash","time":"1501592129","uid":"0","username":"root"},"action":"added"}