From d17bbf7e180397d446ba26b59e9b252756ee9088 Mon Sep 17 00:00:00 2001
From: ycz008 <yangchengzi@seethingx.com>
Date: Fri, 1 Mar 2024 14:35:39 +0800
Subject: [PATCH] logstal filter field drop

---
 dev-upgrade/elastic/logstash-alert.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dev-upgrade/elastic/logstash-alert.yaml b/dev-upgrade/elastic/logstash-alert.yaml
index ac86efa..9c9d0ce 100644
--- a/dev-upgrade/elastic/logstash-alert.yaml
+++ b/dev-upgrade/elastic/logstash-alert.yaml
@@ -41,6 +41,9 @@ data:
       if [message] =~ "exchange refresh token" {
         drop {}  
       }
+      if [message] =~ "No sess token provided" {
+        drop {}  
+      }
       mutate {
         split => { "[log][file][path]" => "/" }
         add_field => { "env" => "%{[log][file][path][3]}" }
@@ -147,4 +150,4 @@ spec:
       targetPort: 5044
   selector:
     app: logstash-alert
-  type: ClusterIP
\ No newline at end of file
+  type: ClusterIP