diff --git a/sumologic/resource_sumologic_cse_aggregation_rule.go b/sumologic/resource_sumologic_cse_aggregation_rule.go index 7d5f7177..36986a4d 100644 --- a/sumologic/resource_sumologic_cse_aggregation_rule.go +++ b/sumologic/resource_sumologic_cse_aggregation_rule.go @@ -1,9 +1,11 @@ package sumologic import ( + "log" + "strings" + "github.com/hashicorp/terraform-plugin-sdk/helper/schema" "github.com/hashicorp/terraform-plugin-sdk/helper/validation" - "log" ) func resourceSumologicCSEAggregationRule() *schema.Resource { @@ -99,6 +101,10 @@ func resourceSumologicCSEAggregationRule() *schema.Resource { Type: schema.TypeString, Required: true, }, + "window_size_millis": { + Type: schema.TypeString, + Optional: true, + }, }, } } @@ -136,7 +142,9 @@ func resourceSumologicCSEAggregationRuleRead(d *schema.ResourceData, meta interf d.Set("tags", CSEAggregationRuleGet.Tags) d.Set("trigger_expression", CSEAggregationRuleGet.TriggerExpression) d.Set("window_size", CSEAggregationRuleGet.WindowSizeName) - + if strings.EqualFold(CSEAggregationRuleGet.WindowSizeName, "CUSTOM") { + d.Set("window_size_millis", CSEAggregationRuleGet.WindowSize) + } return nil } @@ -152,22 +160,23 @@ func resourceSumologicCSEAggregationRuleCreate(d *schema.ResourceData, meta inte if d.Id() == "" { id, err := c.CreateCSEAggregationRule(CSEAggregationRule{ - AggregationFunctions: resourceToAggregationFunctionsArray(d.Get("aggregation_functions").([]interface{})), - DescriptionExpression: d.Get("description_expression").(string), - Enabled: d.Get("enabled").(bool), - EntitySelectors: resourceToEntitySelectorArray(d.Get("entity_selectors").([]interface{})), - GroupByEntity: d.Get("group_by_entity").(bool), - GroupByFields: resourceToStringArray(d.Get("group_by_fields").([]interface{})), - IsPrototype: d.Get("is_prototype").(bool), - MatchExpression: d.Get("match_expression").(string), - Name: d.Get("name").(string), - NameExpression: d.Get("name_expression").(string), - SeverityMapping: resourceToSeverityMapping(d.Get("severity_mapping").([]interface{})[0]), - Stream: "record", - SummaryExpression: d.Get("summary_expression").(string), - Tags: resourceToStringArray(d.Get("tags").([]interface{})), - TriggerExpression: d.Get("trigger_expression").(string), - WindowSize: windowSizeField(d.Get("window_size").(string)), + AggregationFunctions: resourceToAggregationFunctionsArray(d.Get("aggregation_functions").([]interface{})), + DescriptionExpression: d.Get("description_expression").(string), + Enabled: d.Get("enabled").(bool), + EntitySelectors: resourceToEntitySelectorArray(d.Get("entity_selectors").([]interface{})), + GroupByEntity: d.Get("group_by_entity").(bool), + GroupByFields: resourceToStringArray(d.Get("group_by_fields").([]interface{})), + IsPrototype: d.Get("is_prototype").(bool), + MatchExpression: d.Get("match_expression").(string), + Name: d.Get("name").(string), + NameExpression: d.Get("name_expression").(string), + SeverityMapping: resourceToSeverityMapping(d.Get("severity_mapping").([]interface{})[0]), + Stream: "record", + SummaryExpression: d.Get("summary_expression").(string), + Tags: resourceToStringArray(d.Get("tags").([]interface{})), + TriggerExpression: d.Get("trigger_expression").(string), + WindowSize: windowSizeField(d.Get("window_size").(string)), + WindowSizeMilliseconds: d.Get("window_size_millis").(string), }) if err != nil { @@ -229,22 +238,23 @@ func resourceToCSEAggregationRule(d *schema.ResourceData) (CSEAggregationRule, e } return CSEAggregationRule{ - ID: id, - AggregationFunctions: resourceToAggregationFunctionsArray(d.Get("aggregation_functions").([]interface{})), - DescriptionExpression: d.Get("description_expression").(string), - Enabled: d.Get("enabled").(bool), - EntitySelectors: resourceToEntitySelectorArray(d.Get("entity_selectors").([]interface{})), - GroupByEntity: d.Get("group_by_entity").(bool), - GroupByFields: resourceToStringArray(d.Get("group_by_fields").([]interface{})), - IsPrototype: d.Get("is_prototype").(bool), - MatchExpression: d.Get("match_expression").(string), - Name: d.Get("name").(string), - NameExpression: d.Get("name_expression").(string), - SeverityMapping: resourceToSeverityMapping(d.Get("severity_mapping").([]interface{})[0]), - Stream: "record", - SummaryExpression: d.Get("summary_expression").(string), - Tags: resourceToStringArray(d.Get("tags").([]interface{})), - TriggerExpression: d.Get("trigger_expression").(string), - WindowSize: windowSizeField(d.Get("window_size").(string)), + ID: id, + AggregationFunctions: resourceToAggregationFunctionsArray(d.Get("aggregation_functions").([]interface{})), + DescriptionExpression: d.Get("description_expression").(string), + Enabled: d.Get("enabled").(bool), + EntitySelectors: resourceToEntitySelectorArray(d.Get("entity_selectors").([]interface{})), + GroupByEntity: d.Get("group_by_entity").(bool), + GroupByFields: resourceToStringArray(d.Get("group_by_fields").([]interface{})), + IsPrototype: d.Get("is_prototype").(bool), + MatchExpression: d.Get("match_expression").(string), + Name: d.Get("name").(string), + NameExpression: d.Get("name_expression").(string), + SeverityMapping: resourceToSeverityMapping(d.Get("severity_mapping").([]interface{})[0]), + Stream: "record", + SummaryExpression: d.Get("summary_expression").(string), + Tags: resourceToStringArray(d.Get("tags").([]interface{})), + TriggerExpression: d.Get("trigger_expression").(string), + WindowSize: windowSizeField(d.Get("window_size").(string)), + WindowSizeMilliseconds: d.Get("window_size_millis").(string), }, nil } diff --git a/sumologic/resource_sumologic_cse_aggregation_rule_test.go b/sumologic/resource_sumologic_cse_aggregation_rule_test.go index 0b6dacc6..9952ac25 100644 --- a/sumologic/resource_sumologic_cse_aggregation_rule_test.go +++ b/sumologic/resource_sumologic_cse_aggregation_rule_test.go @@ -1,79 +1,135 @@ package sumologic import ( + "bytes" "fmt" + "strings" "testing" + "text/template" + "github.com/google/uuid" "github.com/hashicorp/terraform-plugin-sdk/helper/resource" "github.com/hashicorp/terraform-plugin-sdk/terraform" + "github.com/stretchr/testify/assert" ) -func TestAccSumologicCSEAggregationRule_createAndUpdate(t *testing.T) { +func TestAccSumologicCSEAggregationRule_createAndUpdateWithCustomWindowSize(t *testing.T) { + SkipCseTest(t) + + payload := getCSEAggregationRuleTestPayload() + payload.WindowSize = "CUSTOM" + payload.WindowSizeMilliseconds = "10800000" // 3h + + updatedPayload := payload + updatedPayload.WindowSizeMilliseconds = "14400000" // 4h + + var aggregationRule CSEAggregationRule + resourceName := "sumologic_cse_aggregation_rule.aggregation_rule" + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCSEAggregationRuleDestroy, + Steps: []resource.TestStep{ + { // create + Config: testCreateCSEAggregationRuleConfig(t, &payload), + Check: resource.ComposeTestCheckFunc( + testCheckCSEAggregationRuleExists(resourceName, &aggregationRule), + testCheckCSEAggregationRuleValues(t, &payload, &aggregationRule), + resource.TestCheckResourceAttrSet(resourceName, "id"), + ), + }, + { // update + Config: testCreateCSEAggregationRuleConfig(t, &updatedPayload), + Check: resource.ComposeTestCheckFunc( + testCheckCSEAggregationRuleExists(resourceName, &aggregationRule), + testCheckCSEAggregationRuleValues(t, &updatedPayload, &aggregationRule), + ), + }, + { // import + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + }, + }, + }) +} + +func TestAccSumologicCSEAggregationRule_createAndUpdateToCustomWindowSize(t *testing.T) { SkipCseTest(t) - var AggregationRule CSEAggregationRule - aggregationFunctionName := "distinct_eventid_count" - aggregationFunction := "count_distinct" - aggregationFunctionArgument := "metadata_deviceEventId" - descriptionExpression := "Test description" - enabled := true - entitySelectorEntityType := "_ip" - entitySelectorExpression := "srcDevice_ip" - groupByEntity := true - groupByField := "dstDevice_hostname" - isPrototype := false - matchExpression := "foo = bar" - name := "Test Aggregation Rule" - nameExpression := "Signal Name" - severityMappingType := "constant" - severityMappingDefault := 5 - summaryExpression := "Signal Summary" - triggerExpression := "foo = bar" - tag := "foo" - windowSize := "T30M" - - nameUpdated := "Updated Aggregation Rule" - tagUpdated := "bar" + payload := getCSEAggregationRuleTestPayload() + payload.WindowSize = "T30M" + payload.WindowSizeMilliseconds = "irrelevant" + + updatedPayload := payload + updatedPayload.WindowSize = "CUSTOM" + updatedPayload.WindowSizeMilliseconds = "14400000" // 4h + var aggregationRule CSEAggregationRule resourceName := "sumologic_cse_aggregation_rule.aggregation_rule" resource.Test(t, resource.TestCase{ PreCheck: func() { testAccPreCheck(t) }, Providers: testAccProviders, CheckDestroy: testAccCSEAggregationRuleDestroy, Steps: []resource.TestStep{ - { - Config: testCreateCSEAggregationRuleConfig(aggregationFunctionName, aggregationFunction, - aggregationFunctionArgument, descriptionExpression, enabled, entitySelectorEntityType, - entitySelectorExpression, groupByEntity, groupByField, isPrototype, matchExpression, - name, nameExpression, severityMappingType, severityMappingDefault, summaryExpression, - triggerExpression, tag, windowSize), + { // create + Config: testCreateCSEAggregationRuleConfig(t, &payload), Check: resource.ComposeTestCheckFunc( - testCheckCSEAggregationRuleExists(resourceName, &AggregationRule), - testCheckAggregationRuleValues(&AggregationRule, aggregationFunctionName, - aggregationFunction, aggregationFunctionArgument, descriptionExpression, enabled, - entitySelectorEntityType, entitySelectorExpression, groupByEntity, groupByField, - isPrototype, matchExpression, name, nameExpression, severityMappingType, - severityMappingDefault, summaryExpression, triggerExpression, tag, windowSize), + testCheckCSEAggregationRuleExists(resourceName, &aggregationRule), + testCheckCSEAggregationRuleValues(t, &payload, &aggregationRule), resource.TestCheckResourceAttrSet(resourceName, "id"), ), }, - { - Config: testCreateCSEAggregationRuleConfig(aggregationFunctionName, aggregationFunction, - aggregationFunctionArgument, descriptionExpression, enabled, entitySelectorEntityType, - entitySelectorExpression, groupByEntity, groupByField, isPrototype, matchExpression, - nameUpdated, nameExpression, severityMappingType, severityMappingDefault, summaryExpression, - triggerExpression, tagUpdated, windowSize), + { // update + Config: testCreateCSEAggregationRuleConfig(t, &updatedPayload), + Check: resource.ComposeTestCheckFunc( + testCheckCSEAggregationRuleExists(resourceName, &aggregationRule), + testCheckCSEAggregationRuleValues(t, &updatedPayload, &aggregationRule), + ), + }, + { // import + ResourceName: resourceName, + ImportState: true, + ImportStateVerify: true, + }, + }, + }) +} + +func TestAccSumologicCSEAggregationRule_createAndUpdate(t *testing.T) { + SkipCseTest(t) + + payload := getCSEAggregationRuleTestPayload() + payload.WindowSize = "T30M" + payload.WindowSizeMilliseconds = "irrelevant" + + updatedPayload := payload + updatedPayload.Name = fmt.Sprintf("Updated Aggregation Rule %s", uuid.New()) + updatedPayload.WindowSize = "T12H" + + var aggregationRule CSEAggregationRule + resourceName := "sumologic_cse_aggregation_rule.aggregation_rule" + resource.Test(t, resource.TestCase{ + PreCheck: func() { testAccPreCheck(t) }, + Providers: testAccProviders, + CheckDestroy: testAccCSEAggregationRuleDestroy, + Steps: []resource.TestStep{ + { // create + Config: testCreateCSEAggregationRuleConfig(t, &payload), Check: resource.ComposeTestCheckFunc( - testCheckCSEAggregationRuleExists(resourceName, &AggregationRule), - testCheckAggregationRuleValues(&AggregationRule, aggregationFunctionName, - aggregationFunction, aggregationFunctionArgument, descriptionExpression, enabled, - entitySelectorEntityType, entitySelectorExpression, groupByEntity, groupByField, - isPrototype, matchExpression, nameUpdated, nameExpression, severityMappingType, - severityMappingDefault, summaryExpression, triggerExpression, tagUpdated, windowSize), + testCheckCSEAggregationRuleExists(resourceName, &aggregationRule), + testCheckCSEAggregationRuleValues(t, &payload, &aggregationRule), resource.TestCheckResourceAttrSet(resourceName, "id"), ), }, - { + { // update + Config: testCreateCSEAggregationRuleConfig(t, &updatedPayload), + Check: resource.ComposeTestCheckFunc( + testCheckCSEAggregationRuleExists(resourceName, &aggregationRule), + testCheckCSEAggregationRuleValues(t, &updatedPayload, &aggregationRule), + ), + }, + { // import ResourceName: resourceName, ImportState: true, ImportStateVerify: true, @@ -105,46 +161,85 @@ func testAccCSEAggregationRuleDestroy(s *terraform.State) error { return nil } -func testCreateCSEAggregationRuleConfig( - aggregationFunctionName string, aggregationFunction string, - aggregationFunctionArgument string, descriptionExpression string, enabled bool, - entitySelectorEntityType string, entitySelectorExpression string, groupByEntity bool, - groupByField string, isPrototype bool, matchExpression string, name string, - nameExpression string, severityMappingType string, severityMappingDefault int, - summaryExpression string, triggerExpression string, tag string, windowSize string) string { - return fmt.Sprintf(` -resource "sumologic_cse_aggregation_rule" "aggregation_rule" { - aggregation_functions { - name = "%s" - function = "%s" - arguments = ["%s"] +func testCreateCSEAggregationRuleConfig(t *testing.T, payload *CSEAggregationRule) string { + resourceTemplate := ` + resource "sumologic_cse_aggregation_rule" "aggregation_rule" { + {{ range .AggregationFunctions }} + aggregation_functions { + name = "{{ .Name }}" + function = "{{ .Function }}" + arguments = {{ quoteStringArray .Arguments }} + } + {{ end }} + description_expression = "{{ .DescriptionExpression }}" + enabled = {{ .Enabled }} + {{ range .EntitySelectors }} + entity_selectors { + entity_type = "{{ .EntityType }}" + expression = "{{ .Expression }}" + } + {{ end }} + group_by_entity = {{ .GroupByEntity }} + group_by_fields = {{ quoteStringArray .GroupByFields }} + is_prototype = {{ .IsPrototype }} + match_expression = "{{ js .MatchExpression }}" + name = "{{ .Name }}" + name_expression = "{{ .NameExpression }}" + severity_mapping { + type = "{{ .SeverityMapping.Type }}" + default = {{ .SeverityMapping.Default }} + } + summary_expression = "{{ .SummaryExpression }}" + trigger_expression = "{{ js .TriggerExpression }}" + tags = {{ quoteStringArray .Tags }} + window_size = "{{ .WindowSize }}" + {{ if eq .WindowSize "CUSTOM" }} + window_size_millis = "{{ .WindowSizeMilliseconds }}" + {{ end }} + } + ` + + configTemplate := template.Must(template.New("aggregation_rule").Funcs(template.FuncMap{ + "quoteStringArray": func(arr []string) string { + return `["` + strings.Join(arr, `","`) + `"]` + }, + "js": func(in string) string { + escaped := strings.Replace(in, `"`, `\"`, -1) + escaped = strings.Replace(escaped, `$`, `$$`, -1) // Escape Terraform interpolation + return escaped + }, + }).Parse(resourceTemplate)) + + var buffer bytes.Buffer + if err := configTemplate.Execute(&buffer, payload); err != nil { + t.Error(err) } - description_expression = "%s" - enabled = %t - entity_selectors { - entity_type = "%s" - expression = "%s" - } - group_by_entity = %t - group_by_fields = ["%s"] - is_prototype = %t - match_expression = "%s" - name = "%s" - name_expression = "%s" - severity_mapping { - type = "%s" - default = %d - } - summary_expression = "%s" - trigger_expression = "%s" - tags = ["%s"] - window_size = "%s" + + return buffer.String() } -`, aggregationFunctionName, aggregationFunction, aggregationFunctionArgument, - descriptionExpression, enabled, entitySelectorEntityType, entitySelectorExpression, - groupByEntity, groupByField, isPrototype, matchExpression, name, nameExpression, - severityMappingType, severityMappingDefault, summaryExpression, triggerExpression, - tag, windowSize) + +func getCSEAggregationRuleTestPayload() CSEAggregationRule { + return CSEAggregationRule{ + AggregationFunctions: []AggregationFunction{{Name: "distinct_eventid_count", Function: "count_distinct", Arguments: []string{"metadata_deviceEventId"}}}, + DescriptionExpression: "Test description", + Enabled: true, + EntitySelectors: []EntitySelector{{EntityType: "_ip", Expression: "srcDevice_ip"}}, + GroupByEntity: true, + GroupByFields: []string{"dstDevice_hostname"}, + IsPrototype: false, + MatchExpression: "foo = bar", + Name: fmt.Sprintf("Test Aggregation Rule %s", uuid.New()), + NameExpression: "Signal Name", + SeverityMapping: SeverityMapping{ + Type: "constant", + Default: 5, + }, + SummaryExpression: "Signal Summary", + TriggerExpression: "foo = bar", + Tags: []string{"foo"}, + WindowSize: windowSizeField("CUSTOM"), + WindowSizeMilliseconds: "10800000", + } } func testCheckCSEAggregationRuleExists(n string, AggregationRule *CSEAggregationRule) resource.TestCheckFunc { @@ -155,7 +250,7 @@ func testCheckCSEAggregationRuleExists(n string, AggregationRule *CSEAggregation } if rs.Primary.ID == "" { - return fmt.Errorf("match rule ID is not set") + return fmt.Errorf("aggregation rule ID is not set") } c := testAccProvider.Meta().(*Client) @@ -170,71 +265,26 @@ func testCheckCSEAggregationRuleExists(n string, AggregationRule *CSEAggregation } } -func testCheckAggregationRuleValues(AggregationRule *CSEAggregationRule, aggregationFunctionName string, - aggregationFunction string, aggregationFunctionArgument string, descriptionExpression string, - enabled bool, entitySelectorEntityType string, entitySelectorExpression string, groupByEntity bool, - groupByField string, isPrototype bool, matchExpression string, name string, nameExpression string, - severityMappingType string, severityMappingDefault int, summaryExpression string, - triggerExpression string, tag string, windowSize string) resource.TestCheckFunc { +func testCheckCSEAggregationRuleValues(t *testing.T, expected *CSEAggregationRule, actual *CSEAggregationRule) resource.TestCheckFunc { return func(s *terraform.State) error { - if AggregationRule.AggregationFunctions[0].Name != aggregationFunctionName { - return fmt.Errorf("bad aggregationFunctionName, expected \"%s\", got %#v", aggregationFunctionName, AggregationRule.AggregationFunctions[0].Name) - } - if AggregationRule.AggregationFunctions[0].Function != aggregationFunction { - return fmt.Errorf("bad aggregationFunction, expected \"%s\", got %#v", aggregationFunction, AggregationRule.AggregationFunctions[0].Function) - } - if AggregationRule.AggregationFunctions[0].Arguments[0] != aggregationFunctionArgument { - return fmt.Errorf("bad aggregationFunctionArgument, expected \"%s\", got %#v", aggregationFunctionArgument, AggregationRule.AggregationFunctions[0].Arguments[0]) - } - if AggregationRule.DescriptionExpression != descriptionExpression { - return fmt.Errorf("bad descriptionExpression, expected \"%s\", got %#v", descriptionExpression, AggregationRule.DescriptionExpression) - } - if AggregationRule.Enabled != enabled { - return fmt.Errorf("bad enabled, expected \"%t\", got %#v", enabled, AggregationRule.Enabled) - } - if AggregationRule.EntitySelectors[0].EntityType != entitySelectorEntityType { - return fmt.Errorf("bad entitySelectorEntityType, expected \"%s\", got %#v", entitySelectorEntityType, AggregationRule.EntitySelectors[0].EntityType) - } - if AggregationRule.EntitySelectors[0].Expression != entitySelectorExpression { - return fmt.Errorf("bad entitySelectorExpression, expected \"%s\", got %#v", entitySelectorExpression, AggregationRule.EntitySelectors[0].Expression) - } - if AggregationRule.GroupByEntity != groupByEntity { - return fmt.Errorf("bad groupByEntity, expected \"%t\", got %#v", groupByEntity, AggregationRule.GroupByEntity) - } - if AggregationRule.GroupByFields[0] != groupByField { - return fmt.Errorf("bad groupByField, expected \"%s\", got %#v", groupByField, AggregationRule.GroupByFields[0]) - } - if AggregationRule.IsPrototype != isPrototype { - return fmt.Errorf("bad isPrototype, expected \"%t\", got %#v", isPrototype, AggregationRule.IsPrototype) + assert.Equal(t, expected.AggregationFunctions, actual.AggregationFunctions) + assert.Equal(t, expected.DescriptionExpression, actual.DescriptionExpression) + assert.Equal(t, expected.Enabled, actual.Enabled) + assert.Equal(t, expected.EntitySelectors, actual.EntitySelectors) + assert.Equal(t, expected.GroupByEntity, actual.GroupByEntity) + assert.Equal(t, expected.GroupByFields, actual.GroupByFields) + assert.Equal(t, expected.IsPrototype, actual.IsPrototype) + assert.Equal(t, expected.MatchExpression, actual.MatchExpression) + assert.Equal(t, expected.Name, actual.Name) + assert.Equal(t, expected.NameExpression, actual.NameExpression) + assert.Equal(t, expected.SeverityMapping, actual.SeverityMapping) + assert.Equal(t, expected.SummaryExpression, actual.SummaryExpression) + assert.Equal(t, expected.TriggerExpression, actual.TriggerExpression) + assert.Equal(t, expected.Tags, actual.Tags) + assert.Equal(t, string(expected.WindowSize), actual.WindowSizeName) + if strings.EqualFold(actual.WindowSizeName, "CUSTOM") { + assert.Equal(t, expected.WindowSizeMilliseconds, string(actual.WindowSize)) } - if AggregationRule.MatchExpression != matchExpression { - return fmt.Errorf("bad matchExpression, expected \"%s\", got %#v", matchExpression, AggregationRule.MatchExpression) - } - if AggregationRule.Name != name { - return fmt.Errorf("bad name, expected \"%s\", got %#v", name, AggregationRule.Name) - } - if AggregationRule.NameExpression != nameExpression { - return fmt.Errorf("bad nameExpression, expected \"%s\", got %#v", nameExpression, AggregationRule.NameExpression) - } - if AggregationRule.SeverityMapping.Type != severityMappingType { - return fmt.Errorf("bad severityMappingType, expected \"%s\", got %#v", severityMappingType, AggregationRule.SeverityMapping.Type) - } - if AggregationRule.SeverityMapping.Default != severityMappingDefault { - return fmt.Errorf("bad severityMappingDefault, expected \"%d\", got %#v", severityMappingDefault, AggregationRule.SeverityMapping.Default) - } - if AggregationRule.SummaryExpression != summaryExpression { - return fmt.Errorf("bad summaryExpression, expected \"%s\", got %#v", summaryExpression, AggregationRule.SummaryExpression) - } - if AggregationRule.Tags[0] != tag { - return fmt.Errorf("bad tag, expected \"%s\", got %#v", tag, AggregationRule.Tags[0]) - } - if AggregationRule.TriggerExpression != triggerExpression { - return fmt.Errorf("bad triggerExpression, expected \"%s\", got %#v", triggerExpression, AggregationRule.TriggerExpression) - } - if AggregationRule.WindowSizeName != windowSize { - return fmt.Errorf("bad windowSize, expected \"%s\", got %#v", windowSize, AggregationRule.WindowSize) - } - return nil } } diff --git a/sumologic/sumologic_cse_aggregation_rule.go b/sumologic/sumologic_cse_aggregation_rule.go index 2f51d6e3..353ab33d 100644 --- a/sumologic/sumologic_cse_aggregation_rule.go +++ b/sumologic/sumologic_cse_aggregation_rule.go @@ -79,22 +79,23 @@ type AggregationFunction struct { } type CSEAggregationRule struct { - ID string `json:"id,omitempty"` - AggregationFunctions []AggregationFunction `json:"aggregationFunctions"` - DescriptionExpression string `json:"descriptionExpression"` - Enabled bool `json:"enabled"` - EntitySelectors []EntitySelector `json:"entitySelectors"` - GroupByEntity bool `json:"groupByAsset"` - GroupByFields []string `json:"groupByFields"` - IsPrototype bool `json:"isPrototype"` - MatchExpression string `json:"matchExpression"` - Name string `json:"name"` - NameExpression string `json:"nameExpression"` - SeverityMapping SeverityMapping `json:"scoreMapping"` - Stream string `json:"stream"` - SummaryExpression string `json:"summaryExpression"` - TriggerExpression string `json:"triggerExpression"` - Tags []string `json:"tags"` - WindowSize windowSizeField `json:"windowSize,omitempty"` - WindowSizeName string `json:"windowSizeName,omitempty"` + ID string `json:"id,omitempty"` + AggregationFunctions []AggregationFunction `json:"aggregationFunctions"` + DescriptionExpression string `json:"descriptionExpression"` + Enabled bool `json:"enabled"` + EntitySelectors []EntitySelector `json:"entitySelectors"` + GroupByEntity bool `json:"groupByAsset"` + GroupByFields []string `json:"groupByFields"` + IsPrototype bool `json:"isPrototype"` + MatchExpression string `json:"matchExpression"` + Name string `json:"name"` + NameExpression string `json:"nameExpression"` + SeverityMapping SeverityMapping `json:"scoreMapping"` + Stream string `json:"stream"` + SummaryExpression string `json:"summaryExpression"` + TriggerExpression string `json:"triggerExpression"` + Tags []string `json:"tags"` + WindowSize windowSizeField `json:"windowSize,omitempty"` + WindowSizeName string `json:"windowSizeName,omitempty"` + WindowSizeMilliseconds string `json:"windowSizeMilliseconds,omitempty"` } diff --git a/website/docs/r/cse_aggregation_rule.html.markdown b/website/docs/r/cse_aggregation_rule.html.markdown index 3627e181..ff5ec753 100644 --- a/website/docs/r/cse_aggregation_rule.html.markdown +++ b/website/docs/r/cse_aggregation_rule.html.markdown @@ -69,7 +69,8 @@ The following arguments are supported: - `summary_expression` - (Optional) The summary of the generated Signals - `tags` - (Required) The tags of the generated Signals - `trigger_expression` - (Required) The expression to determine whether a Signal should be created based on the aggregation results -- `window_size` - (Required) How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, or T05D. +- `window_size` - (Required) How long of a window to aggregate records for. Current acceptable values are T05M, T10M, T30M, T60M, T24H, T12H, T05D or CUSTOM + + `window_size_millis` - (Optional) Used only when `window_size` is set to CUSTOM. Window size in milliseconds ranging from 1 minute to 5 days ("60000" to "432000000"). The following attributes are exported: