Skip to content

add local windows event log source #785

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

rjury-sumo
Copy link
Collaborator

This PR adds support for a local windows events source for the installed collector. Like the local file source this is a special case as it can only be applied to existing installed collectors rather than to a hosted collector.

I don't have tests for this (the local file source doesn't either) - but have successfully been able to create or modify sources on a windows instance with installed collector installed using the two example configurations in the markdown file.

This was requested by one sumo customer and has an internal JIRA field request https://sumologic.atlassian.net/browse/FIELD-95

Closes #581

you can test vs an installed windows collector with

terraform {
  required_providers {
    sumologic = {
      source = "sumologic.com/dev/sumologic"
      version = "~> 1.0.0"
    }
  }
}

data "sumologic_collector" "installed_collector" {
  name = "terraform_source_testing"
}

resource "sumologic_local_windows_event_log_source" "local" {
  name             = "windows_logs"
  description      = "windows system and application logs in json format"
  category         = "/os/windows/events"
  collector_id     = "${data.sumologic_collector.installed_collector.id}"
  log_names  = ["System","Application","Microsoft-Windows-PowerShell/Operational", "Microsoft-Windows-TaskScheduler/Operational"]
  deny_list = "9999,7890"
 // allow_list = "1000,2000"
  event_format = 1 // 0 = XML, 1 = JSON
}

replaces PR #783

Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds support for a local Windows event log source for installed collectors in the Terraform provider. This addresses a customer request and provides the ability to configure Windows event log collection through Terraform for locally installed collectors.

Key changes include:

  • Implementation of a new resource type sumologic_local_windows_event_log_source with comprehensive configuration options
  • Support for both XML and JSON event formats with configurable filtering via allow/deny lists
  • Documentation and examples showing usage with installed collectors

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
website/docs/r/local_windows_event_source.html.markdown Comprehensive documentation with examples and parameter descriptions
sumologic/sumologic_local_windows_event_log_source.go Client API methods for CRUD operations on Windows event log sources
sumologic/resource_sumologic_local_windows_event_log_source.go Terraform resource implementation with schema and lifecycle methods
sumologic/provider.go Registration of the new resource in the provider
CHANGELOG.md Addition of changelog entry for the new feature

* `deny_list` - Comma-separated list of event IDs to deny
* `category` - (Optional) The default source category for the source.
* `fields` - (Optional) Map containing [key/value pairs][2].
* `denylist` - (Optional) Comma-separated list of event IDs to deny. This is used to exclude specific events from being collected.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

deny_list is already mentioned at L59. Probably this should be allow_list as that is missing in the docs.


Note that installed collector sources must be treated as a special case as the user must have a pipeline to install them outside of terraform as it is not possible to install a local collector via the API, that must be done locally on the instance. Make sure the collector is in cloud managed not local json file mode to allow for API based configuration.

Use the installed collector data source to map to installed collector instances by name or id.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line can be removed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

local windows event log source
2 participants