Terraform Google 提供商，创建基于日志的警报策略

Question

I need to create a log-based alerting policy via Terraform Google cloud provider: https://cloud.google.com/logging/docs/alerting/monitoring-logs#lba

I checked from the Terraform official documentation and i saw 'google_monitoring_alert_policy' resource: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/monitoring_alert_policy

I don't found with this doc how creating a log based alerting policy.
I can create an alerting policy with type 'Metrics' but not with type 'Logs'

I use the latest version of Terraform Google cloud provider:https://registry.terraform.io/providers/hashicorp/google/latest

How can i create a log-based alerting policy with Terraform Google provider please?

Thanks in advance for your help.

Answer 1

Thanks Guillaume.

Yes it's the way i solved the issue.

Now there is no way to directly create alerting with 'log' type, via Terraform.

The steps to solve this problem:

• Create un log based metric with expected filter
• Create an alerting policy with type 'metric' based on the previous created log based metric

resource "google_logging_metric" "my_log_metrics" {
  project = var.project_id
  name = "my-log-metric"
  filter = "..."
  description = "..."
  metric_descriptor {
    metric_kind = "..."
    value_type = "..."
  }
}

resource "google_monitoring_alert_policy" "my_policy" {
  project = var.project_id
  display_name = "my-policy"
  combiner = "OR"
  conditions {
    display_name = "my-policy"
    condition_threshold {
      filter = "metric.type=\"logging.googleapis.com/user/my-log-metric\" AND resource.type=\"cloud_composer_environment\""
    ...
    }
}

Answer 2

Problem is solved with version 4.7.0 of google provider, which adds condition_matched_log . Here is a working example:

resource "google_monitoring_notification_channel" "email-me" {
  display_name = "Email Me"
  type = "email"
  labels = {
    email_address = "me@mycompany.com"
  }
  
}

resource "google_monitoring_alert_policy" "workflows" {
  display_name = "Workflows alert policy"
  combiner     = "OR"
  conditions {
    display_name = "Error condition"
    condition_matched_log {
      filter = "resource.type=\"workflows.googleapis.com/Workflow\" severity=ERROR"
    }
  }

  notification_channels = [ google_monitoring_notification_channel.email-me.name ]
  alert_strategy {
    notification_rate_limit {
      period = "300s"
    }
  }
}

Answer 3

The format is logging.googleapis.com/user/<user metrics name>

Look at this example (no notification, only the alert policy)

resource "google_monitoring_alert_policy" "alert_policy" {
  display_name = "My Alert Policy"
  combiner     = "OR"
  conditions {
    display_name = "test condition"
    condition_threshold {
      filter     = "metric.type=\"logging.googleapis.com/user/test-metrics\" AND resource.type=\"cloud_run_revision\""
      duration   = "600s"
      comparison = "COMPARISON_GT"
      threshold_value = 1
      }
    }

  user_labels = {
    foo = "bar"
  }
}