Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Kibana alerting - 'alert after "n" consecutive matches' issue when updating using Terraform #830

Open
ASH895-N opened this issue Oct 4, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@ASH895-N
Copy link

ASH895-N commented Oct 4, 2024

Describe the bug
In Kibana alerting UI
Rules -> Advanced options -> alert ____ consecutive matches
this is same as alert_delay field in Terraform configuration: https://registry.terraform.io/providers/elastic/elasticstack/latest/docs/resources/kibana_alerting_rule#alert_delay

When we use this setting in Terraform to create an alert, it works and sets the correct value for alert_delay as expected. But, if we try to update using Terraform, it sets to default value of 1 instead of a specific value.

To Reproduce
Steps to reproduce the behavior:

resource "elasticstack_kibana_alerting_rule" "consecutive_matches" {
    consumer              = "stackAlerts"
    enabled               = true
    interval              = "1m"
    name                  = "test-consecutive-matches-tf"
    params                = ...
    rule_type_id          = ".es-query"
    alert_delay           = 30 ---------> This 
    space_id              = "default"

    actions {
        group  = "query matched"
        id     = "connector_id"
        params = ....
        ...

        frequency {
            notify_when = "onActionGroupChange"
            summary     = false
        }
    }

}

GET API call

{
 "actions": [
  {
   "alerts_filter": {
   .....
   },
   "frequency": {
    "notify_when": "onActionGroupChange",
    "summary": false
   },
   "group": "query matched",
   "id": "connector_id",
   "params": {
    "subAction": "postMessage",
    "subActionParams": {
     "channelIds": [
      "channelID"
     ],
     "text": "*This is a sample"
    }
   }
  }
 ],
 "alert_delay": {
  "active": 30
 },
 "consumer": "stackAlerts",
 "enabled": true,
 "name": "test-consecutive-matches-tf",
 "params": {
  "aggType": "count",
  "excludeHitsFromPreviousRun": true,
  "groupBy": "top",
  .....
}
}

If I perform a GET API call, we can see the setting -

    "alertDelay": {
        "active": 30
    },

I'll update this value from 30 -> 50 and Terraform plan -

Terraform will perform the following actions:

  # elasticstack_kibana_alerting_rule.consecutive_matches will be updated in-place
  ~ resource "elasticstack_kibana_alerting_rule" "consecutive_matches" {
      ~ alert_delay           = 30 -> 50
        id                    = "default/xxxxxxxxx"
        name                  = "test-custom-interval-tf"
        tags                  = []
        # (10 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

The plan shows the upcoming changes. But upon Terraform apply, if I look at the debug logs, the PUT API call that terraform performs for updating the resource, does not have this value set. There is no field in the API call. Hence it defaults to 1.

Trying from API call - PUT , setting -

    "alertDelay": {
        "active": 50
    },

I get the following error

{
    "statusCode": 400,
    "error": "Bad Request",
    "message": "[request body.alertDelay]: definition for this key is missing"
}

So, from API call as well, if we remove this setting, it will be same as the PUT call Terraform performs. As there is no alert_delay setting, the alert is updated to default value of 1.

Screenshots
If applicable, add screenshots to help explain your problem.

Versions (please complete the following information):

  • Terraform Version : 1.6.6
  • Provider version : v0.11.7
  • Elasticsearch Version : 8.13.2

Let me know if more information is required from my die.

@ASH895-N ASH895-N added the bug Something isn't working label Oct 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant