Query alert not showing filter query in datadog ui

[jesusgy]

Hi there,

Can you help me please.. I try to create a monitor log alert and the result are horrible.. the query is(see log_alert1) log_alert1.pdf

but when I open the monitor to edit the field query is empty and the graphic shows bad information log_alert2.pdf

the next is the query: "query" : "logs(\"kube_cluster_name:prod kube_namespace:siigo-alliances status:(error OR emergency) service:ms-siigoapi\").index(\"*\").rollup(\"count\").last(\"5m\") > 40"

[bkonicekprivo]

I'm also seeing this. Example query is "logs(\"host:XXXXX* @aws.awslogs.owner:ACCOUNTID error\").index(\"*\").rollup(\"count\").last(\"5m\") >= 1".

After apply the query shows on the monitor, but if I go to edit the query it is blank.

If I manually edit the query to work correctly and run another terraform apply it reports no changes to be made, so it doesn't appear to be a syntax error in my code.

Datadog provider: v3.2.0 Terraform version: 0.13.5

[therve]

Hi,

Can you provide a full terraform config showing the example, and the version you're using? Both queries seem to work fine for me when testing it with latest release and terraform 0.13. Thanks.

[bkonicekprivo]

Hi @therve ,

Here is a test resource I created within the same codebase

resource "datadog_monitor" "test_provider" {
  name = "test alert - ignore"
  type = "log alert"

  message = <<EOM
{{#is_alert}}
This is a test - ignore

Notify: 
{{/is_alert}}

EOM

  query = "logs(\"source:cloudwatch host:\"/aws/events/codepipeline\" @aws.awslogs.owner:1111111111 status:emergency\").index(\"*\").rollup(\"count\").last(\"5m\") >= 1"

  monitor_thresholds {
    critical = 1
    # ok = 0
  }

  enable_logs_sample  = true
  notify_no_data      = false
  renotify_interval   = 0
  require_full_window = true
  no_data_timeframe   = null
  tags                = ["log", "terraform"]
}

Here is my provider definition:

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
    datadog = {
      source = "datadog/datadog"
    }
  }

}

and my terraform version output

bkonicek@PRI-XPS13-BK:~$ terraform version
Terraform v0.13.5
+ provider registry.terraform.io/datadog/datadog v3.2.0
+ provider registry.terraform.io/hashicorp/aws v3.50.0

It successfully applies and creates the monitor

But when I edit the monitor this is what I see: And the query field in Export Monitor shows as "query": "logs(\"*\").index(\"*\").rollup(\"count\").last(\"5m\") >= 1"

Exporting the monitor the query shows as "query": "logs(\"source:cloudwatch host:\\\"/aws/events/codepipeline\\\" @aws.awslogs.owner:1111111111 status:emergency\").index(\"*\").rollup(\"count\").last(\"5m\") >= 1", - the 3 \\\ didn't used to be there, as we had copied the query exactly from the dashboard when creating the terraform resources, however even if I update my resource's query to match it, an apply still results in an empty query in the dashboard.

[jesusgy]

In my case, I am using: Terraform v0.15.4 Provider: registry.terraform.io/datadog/datadog v3.2.0(latest)

[therve]

Oh OK, so this is an issue with the UI. Can you please open a ticket with support? They'll be able to help you out. Thanks.

[bkonicekprivo]

Support ended up confirming that this was an issue in the UI and it's since been fixed. Creating/modifying monitors is working properly for me again.