-
Notifications
You must be signed in to change notification settings - Fork 61
add local windows event log source #785
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds support for a local Windows event log source for installed collectors in the Terraform provider. This addresses a customer request and provides the ability to configure Windows event log collection through Terraform for locally installed collectors.
Key changes include:
- Implementation of a new resource type
sumologic_local_windows_event_log_source
with comprehensive configuration options - Support for both XML and JSON event formats with configurable filtering via allow/deny lists
- Documentation and examples showing usage with installed collectors
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.
Show a summary per file
File | Description |
---|---|
website/docs/r/local_windows_event_source.html.markdown | Comprehensive documentation with examples and parameter descriptions |
sumologic/sumologic_local_windows_event_log_source.go | Client API methods for CRUD operations on Windows event log sources |
sumologic/resource_sumologic_local_windows_event_log_source.go | Terraform resource implementation with schema and lifecycle methods |
sumologic/provider.go | Registration of the new resource in the provider |
CHANGELOG.md | Addition of changelog entry for the new feature |
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
* `deny_list` - Comma-separated list of event IDs to deny | ||
* `category` - (Optional) The default source category for the source. | ||
* `fields` - (Optional) Map containing [key/value pairs][2]. | ||
* `denylist` - (Optional) Comma-separated list of event IDs to deny. This is used to exclude specific events from being collected. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
deny_list
is already mentioned at L59. Probably this should be allow_list
as that is missing in the docs.
|
||
Note that installed collector sources must be treated as a special case as the user must have a pipeline to install them outside of terraform as it is not possible to install a local collector via the API, that must be done locally on the instance. Make sure the collector is in cloud managed not local json file mode to allow for API based configuration. | ||
|
||
Use the installed collector data source to map to installed collector instances by name or id. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This line can be removed.
This PR adds support for a local windows events source for the installed collector. Like the local file source this is a special case as it can only be applied to existing installed collectors rather than to a hosted collector.
I don't have tests for this (the local file source doesn't either) - but have successfully been able to create or modify sources on a windows instance with installed collector installed using the two example configurations in the markdown file.
This was requested by one sumo customer and has an internal JIRA field request https://sumologic.atlassian.net/browse/FIELD-95
Closes #581
you can test vs an installed windows collector with
replaces PR #783