Terraform Google provider, create log-based alerting policy

Question

I need to create a log-based alerting policy via Terraform Google cloud provider : https://cloud.google.com/logging/docs/alerting/monitoring-logs#lba

I checked from the Terraform official documentation and i saw 'google_monitoring_alert_policy' resource : https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/monitoring_alert_policy

I don't found with this doc how creating a log based alerting policy.
I can create an alerting policy with type 'Metrics' but not with type 'Logs'

I use the latest version of Terraform Google cloud provider : https://registry.terraform.io/providers/hashicorp/google/latest

How can i create a log-based alerting policy with Terraform Google provider please ?

Thanks in advance for your help.

There is an open issue in the Terraform provider to support conditionMatchedLog block https://github.com/hashicorp/terraform-provider-google/issues/9893 — Diego Rodríguez, Nov 22 '21 at 11:10

score 8 · Answer 1 · answered Apr 02 '22 at 07:57

Problem is solved with version 4.7.0 of google provider, which adds condition_matched_log. Here is a working example :

resource "google_monitoring_notification_channel" "email-me" {
  display_name = "Email Me"
  type = "email"
  labels = {
    email_address = "me@mycompany.com"
  }
  
}

resource "google_monitoring_alert_policy" "workflows" {
  display_name = "Workflows alert policy"
  combiner     = "OR"
  conditions {
    display_name = "Error condition"
    condition_matched_log {
      filter = "resource.type=\"workflows.googleapis.com/Workflow\" severity=ERROR"
    }
  }

  notification_channels = [ google_monitoring_notification_channel.email-me.name ]
  alert_strategy {
    notification_rate_limit {
      period = "300s"
    }
  }
}

Thank you very much! Is it possible, to add a trigger to it? For example, only if within 60 Min, the condition is reached for 4 times, only then will the alert be triggered? — Zi Sang, Feb 13 '23 at 12:46
In this case you're better off using metrics and trigger values, as shown in the accepted answer to this question. — jhoareau, Mar 08 '23 at 14:27

Mazlum Tosun · Accepted Answer · 2023-01-26T22:29:25.313

4

Thanks Guillaume.

Yes it's the way i solved the issue.

Now there is no way to directly create alerting with log type, via Terraform.

The steps to solve this problem :

Create un log based metric with expected filter
Create an alerting policy with type metric based on the previous created log based metric

resource "google_logging_metric" "my_log_metrics" {
  project = var.project_id
  name = "my-log-metric"
  filter = "..."
  description = "..."
  metric_descriptor {
    metric_kind = "..."
    value_type = "..."
  }
}

resource "google_monitoring_alert_policy" "my_policy" {
  project = var.project_id
  display_name = "my-policy"
  combiner = "OR"
  conditions {
    display_name = "my-policy"
    condition_threshold {
      filter = "metric.type=\"logging.googleapis.com/user/my-log-metric\" AND resource.type=\"cloud_composer_environment\""
    ...
    }
}

edited Jan 26 '23 at 22:29

answered Sep 02 '21 at 15:53

Mazlum Tosun

5,761
1
9
23

Hey Mazlum, What value did you set for metric_kind and value_type? – Richard D Nov 03 '21 at 03:20
1

Hi Richard, for example in my cases, i want to increment the metric and send an alert everytime the pattern occurs in cloud logging. In this case, you can set the following params : "metric_kind": "DELTA", "value_type": "INT64", – Mazlum Tosun Nov 23 '21 at 13:52
Hi Mazlum, many thanks. – Richard D Dec 05 '21 at 00:52

score 1 · Answer 3 · answered Aug 26 '21 at 20:55

The format is logging.googleapis.com/user/<user metrics name>

Look at this example (no notification, only the alert policy)

resource "google_monitoring_alert_policy" "alert_policy" {
  display_name = "My Alert Policy"
  combiner     = "OR"
  conditions {
    display_name = "test condition"
    condition_threshold {
      filter     = "metric.type=\"logging.googleapis.com/user/test-metrics\" AND resource.type=\"cloud_run_revision\""
      duration   = "600s"
      comparison = "COMPARISON_GT"
      threshold_value = 1
      }
    }

  user_labels = {
    foo = "bar"
  }
}

Terraform Google provider, create log-based alerting policy

3 Answers3

Linked