Error: Wrong grammar for condition when writing metrics

[KodieGlosserIBM]

I am using the latest version of terraform sysdig (1.31.0) Full error:

│ Error: Wrong grammar for condition
│ 
│   with sysdig_monitor_alert_metric.total_training_orchestrator_agents_online_below_60,
│   on sysdig-alert.tf line 191, in resource "sysdig_monitor_alert_metric" "total_training_orchestrator_agents_online_below_60":
│  191: resource "sysdig_monitor_alert_metric" "total_training_orchestrator_agents_online_below_60" {
│ 
╵

I have narrowed it down to the metric that it is complaining about.

Example failures:

metric                = "count(group by (host_hostname) (orchestrator_agent_status{type='train',host_hostname=~'dev-rhel-ai-.*'} == 1)) <= 3"

When running terraform import (this condition also fails):

metric                = "count(group by (host_hostname) (orchestrator_agent_status{type=\"train\",host_hostname=~\"dev-rhel-ai-.*\"} == 1)) <= 2"

These are total valid expressions so I'm not sure what the issue is here. Any help is much appreciated!

Running terraform in debug mode shows...

[dbonf]

hi @KodieGlosserIBM , the alert seems to be a prometheus alert, so, use monitor_alert_v2_prometheus resource, the sysdig_monitor_alert_metric are for alerts of type "Threshold (Previously Metric)" using form.

Also please use the "v2" alert resources if possible, the legacy ones are limited in expressiveness, bound to old concepts not visible in ui anymore (for example, with sysdig_monitor_alert_metric you can add a free form sysdig expression with time and group aggregation, see example here, that is not encouraged anymore) and will be deprecated in the near future.

[KodieGlosserIBM]

Wow thanks for the quick and detailed response @dbonf !! This totally solved my problem. Thank you!!!!

[dbonf]

@KodieGlosserIBM I noticed on logs you reported you showed the token of the request, I suggest to rotate if it is still valid.

[KodieGlosserIBM]

Rotated!