From d46ac183af5a311f735852b7a288092eee060985 Mon Sep 17 00:00:00 2001
From: ycz008 <yangchengzi@seethingx.com>
Date: Wed, 28 Feb 2024 18:51:40 +0800
Subject: [PATCH] recover logstash alert field

---
 dev-upgrade/elastic/logstash-alert.yaml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/dev-upgrade/elastic/logstash-alert.yaml b/dev-upgrade/elastic/logstash-alert.yaml
index 6555977..222ade6 100644
--- a/dev-upgrade/elastic/logstash-alert.yaml
+++ b/dev-upgrade/elastic/logstash-alert.yaml
@@ -38,9 +38,7 @@ data:
       if [message] =~ "Unauthorized access" {
         drop {}  
       }
-      if [message] =~ "exchange refresh token" {
-        drop {}  
-      } 
+      
 
       mutate {
         split => { "[log][file][path]" => "/" }