Closed eric-mark closed 10 months ago
Thank you, @teowa. We destroyed our DCR rule and re-applied it:
`# Manages a Data Collection Rule for Log Analytics Workspace resource "azurerm_monitor_data_collection_rule" "dcr_transformation" { name = "${local.prefix}.dcr" resource_group_name = azurerm_resource_group.tf-rg.name location = var.location_map[var.env] description = "SIEM DCR Log Transformation" kind = "WorkspaceTransforms" # bug-fixed https://github.com/hashicorp/terraform-provider-azurerm/issues/23868 -- you must destroy, to change the kind tags = local.tags
destinations { log_analytics { workspace_resource_id = azurerm_log_analytics_workspace.tf-law.id name = "${local.prefix}-log" # cannot use azurerm_log_analytics_workspace.tf-law.name due to race condition } }
data_flow { streams = ["Microsoft-Table-AWSCloudTrail"] destinations = ["${local.prefix}-log"] # azurerm_log_analytics_workspace.tf-law.id does not work transform_kql = "source | extend CipherSuite = '' | extend EventVersion = '' | extend TlsVersion = ''" }
data_flow { streams = ["Microsoft-Table-AWSGuardDuty"] destinations = ["${local.prefix}-log"] # azurerm_log_analytics_workspace.tf-law.id does not work transform_kql = "source | extend Partition = '' | extend SchemaVersion = ''" }
data_flow { streams = ["Microsoft-Table-AADNonInteractiveUserSignInLogs"] destinations = ["${local.prefix}-log"] # azurerm_log_analytics_workspace.tf-law.id does not work transform_kql = "source | extend ConditionalAccessPolicies = '' | extend ConditionalAccessStatus = ''" } }`
Then we re-applied the Log Analytics Workspace association to the DCR rule and everything works.
Thank you!
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
Is there an existing issue for this?
Community Note
Terraform Version
1.6.3
AzureRM Provider Version
3.80
Affected Resource(s)/Data Source(s)
azurerm_monitor_data_collection_rule
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
In the example here, we must pass "kind" = "WorkspaceTransforms." If we do not pass this value, the DCR will not apply against the Log Analytics Workspace.
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-workspace-transformations-api
Actual Behaviour
We receive the following error: expected kind to be one of ["Linux" "Windows" "AgentDirectToStore"], got WorkspaceTransforms
It is not accepting the value required to transform the DCR within the Log Analytics Workspace.
Steps to Reproduce
terraform format terraform validate terraform plan terraform apply
Important Factoids
n/a
References
n/a