Kibana Alert Modification Not Reflecting in Actual Resource

[yh-kwak]

Hello,

I have been using your excellent Terraform tool for automating Kibana alerts, and it has been a great help. Unfortunately, I have encountered what I believe to be a bug, and I wanted to share it with you. I think this issue may not be unique to me, as it can occur quite easily. However, I couldn't find any similar cases in the existing issues.

The issue is quite simple. After creating a Kibana alert, the process of modifying it does not work correctly. I used the example code provided on the Terraform registry (link) to create an alert, and then changed the term_size value to 7 and ran terraform apply.

resource "elasticsearch_kibana_alert" "test" {
  name = "terraform-alert"
  schedule {
    interval = "1m"
  }
  conditions {
    aggregation_type     = "avg"
    term_size            = 6
    threshold_comparator = ">"
    time_window_size     = 5
    time_window_unit     = "m"
    group_by             = "top"
    threshold            = [1000]
    index                = [".test-index"]
    time_field           = "@timestamp"
    aggregation_field    = "sheet.version"
    term_field           = "name.keyword"
  }
  actions {
    id             = "c87f0dc6-c301-4988-aee9-95d391359a39"
    action_type_id = ".index"
    params = {
      level   = "info"
      message = "alert '{{alertName}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{params.timeWindowSize}}{{params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
    }
  }
}

The logs indicate that the change has been completed, but it is not actually reflected in the resource. This issue occurs when changing other options as well, but if I change the name and recreate the alert, the changes are applied correctly.

I am attaching my environment information and debug logs. I hope this issue is due to a minor problem and can be resolved quickly.

Best regards,

My environments

• Elasticsearch/Kibana version - 7.17.7
• terraform-provider-elasticsearch version - 2.0.7

Debug level apply logs

2023-03-21T19:58:12.068+0900 [INFO]  backend/local: apply calling Apply
2023-03-21T19:58:12.068+0900 [DEBUG] Building and walking apply graph for NormalMode plan
2023-03-21T19:58:12.069+0900 [DEBUG] ProviderTransformer: "elasticsearch_kibana_alert.test" (*terraform.NodeApplyableResourceInstance) needs provider["registry.terraform.io/phillbaker/elasticsearch"]
2023-03-21T19:58:12.069+0900 [DEBUG] ProviderTransformer: "elasticsearch_kibana_alert.test (expand)" (*terraform.nodeExpandApplyableResource) needs provider["registry.terraform.io/phillbaker/elasticsearch"]
2023-03-21T19:58:12.069+0900 [DEBUG] ProviderTransformer: "data.aws_secretsmanager_secret_version.elastic_credentials (expand)" (*terraform.nodeExpandApplyableResource) needs provider["registry.terraform.io/hashicorp/aws"]
2023-03-21T19:58:12.070+0900 [DEBUG] ReferenceTransformer: "local.action_id_twilio_call_webhook (expand)" references: []
2023-03-21T19:58:12.070+0900 [DEBUG] ReferenceTransformer: "local.action_id (expand)" references: [local.action_id_alerts_devops_test (expand)]
2023-03-21T19:58:12.070+0900 [DEBUG] ReferenceTransformer: "local.environment (expand)" references: []
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "local.webhook_message_color (expand)" references: []
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "local.action_id_alerts_devops_test (expand)" references: []
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "elasticsearch_kibana_alert.test" references: []
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "elasticsearch_kibana_alert.test (expand)" references: []
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "data.aws_secretsmanager_secret_version.elastic_credentials (expand)" references: []
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "provider[\"registry.terraform.io/hashicorp/aws\"]" references: [local.aws_region (expand)]
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "local.service_prefix (expand)" references: []
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "provider[\"registry.terraform.io/phillbaker/elasticsearch\"]" references: [data.aws_secretsmanager_secret_version.elastic_credentials (expand) data.aws_secretsmanager_secret_version.elastic_credentials (expand)]
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "local.action_id_alerts_hwahae-services (expand)" references: []
2023-03-21T19:58:12.071+0900 [DEBUG] ReferenceTransformer: "local.aws_region (expand)" references: []
2023-03-21T19:58:12.072+0900 [DEBUG] pruneUnusedNodes: local.webhook_message_color (expand) is no longer needed, removing
2023-03-21T19:58:12.072+0900 [DEBUG] pruneUnusedNodes: data.aws_secretsmanager_secret_version.elastic_credentials (expand) is no longer needed, removing
2023-03-21T19:58:12.072+0900 [DEBUG] pruneUnusedNodes: local.action_id_twilio_call_webhook (expand) is no longer needed, removing
2023-03-21T19:58:12.072+0900 [DEBUG] pruneUnusedNodes: local.action_id (expand) is no longer needed, removing
2023-03-21T19:58:12.072+0900 [DEBUG] pruneUnusedNodes: local.environment (expand) is no longer needed, removing
2023-03-21T19:58:12.072+0900 [DEBUG] pruneUnusedNodes: local.action_id_alerts_devops_test (expand) is no longer needed, removing
2023-03-21T19:58:12.073+0900 [DEBUG] pruneUnusedNodes: local.service_prefix (expand) is no longer needed, removing
2023-03-21T19:58:12.073+0900 [DEBUG] pruneUnusedNodes: provider["registry.terraform.io/hashicorp/aws"] is no longer needed, removing
2023-03-21T19:58:12.073+0900 [DEBUG] pruneUnusedNodes: local.action_id_alerts_hwahae-services (expand) is no longer needed, removing
2023-03-21T19:58:12.073+0900 [DEBUG] pruneUnusedNodes: local.aws_region (expand) is no longer needed, removing
2023-03-21T19:58:12.073+0900 [DEBUG] Starting graph walk: walkApply
2023-03-21T19:58:12.074+0900 [DEBUG] created provider logger: level=debug
2023-03-21T19:58:12.074+0900 [INFO]  provider: configuring client automatic mTLS
2023-03-21T19:58:12.083+0900 [DEBUG] provider: starting plugin: path=.terraform/providers/registry.terraform.io/phillbaker/elasticsearch/2.0.7/darwin_arm64/terraform-provider-elasticsearch_v2.0.7 args=[.terraform/providers/registry.terraform.io/phillbaker/elasticsearch/2.0.7/darwin_arm64/terraform-provider-elasticsearch_v2.0.7]
2023-03-21T19:58:12.088+0900 [DEBUG] provider: plugin started: path=.terraform/providers/registry.terraform.io/phillbaker/elasticsearch/2.0.7/darwin_arm64/terraform-provider-elasticsearch_v2.0.7 pid=63108
2023-03-21T19:58:12.088+0900 [DEBUG] provider: waiting for RPC address: path=.terraform/providers/registry.terraform.io/phillbaker/elasticsearch/2.0.7/darwin_arm64/terraform-provider-elasticsearch_v2.0.7
2023-03-21T19:58:12.103+0900 [INFO]  provider.terraform-provider-elasticsearch_v2.0.7: configuring server automatic mTLS: timestamp=2023-03-21T19:58:12.103+0900
2023-03-21T19:58:12.113+0900 [DEBUG] provider: using plugin: version=5
2023-03-21T19:58:12.113+0900 [DEBUG] provider.terraform-provider-elasticsearch_v2.0.7: plugin address: network=unix address=/var/folders/5q/3hf3n8cs75d9d_7f_zf_03fw0000gn/T/plugin1524690262 timestamp=2023-03-21T19:58:12.113+0900
2023-03-21T19:58:12.129+0900 [WARN]  ValidateProviderConfig from "provider[\"registry.terraform.io/phillbaker/elasticsearch\"]" changed the config value, but that value is unused
2023-03-21T19:58:12.133+0900 [WARN]  Provider "registry.terraform.io/phillbaker/elasticsearch" produced an invalid plan for elasticsearch_kibana_alert.test, but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .consumer: planned value cty.StringVal("alerts") for a non-computed attribute
      - .enabled: planned value cty.True for a non-computed attribute
      - .throttle: planned value cty.StringVal("") for a non-computed attribute
      - .alert_type_id: planned value cty.StringVal(".index-threshold") for a non-computed attribute
      - .tags: planned value cty.SetValEmpty(cty.String) for a non-computed attribute
elasticsearch_kibana_alert.test: Modifying... [id=142ef070-c7d7-11ed-b07e-c199b3a60c55]
2023-03-21T19:58:12.133+0900 [INFO]  Starting apply for elasticsearch_kibana_alert.test
2023-03-21T19:58:12.133+0900 [DEBUG] elasticsearch_kibana_alert.test: applying the planned Update change
2023-03-21T19:58:12.195+0900 [INFO]  provider.terraform-provider-elasticsearch_v2.0.7: 2023/03/21 19:58:12 [INFO] Pinging url to determine version `{kibana_url}` with timeout 5s: timestamp=2023-03-21T19:58:12.194+0900
2023-03-21T19:58:12.202+0900 [INFO]  provider.terraform-provider-elasticsearch_v2.0.7: 2023/03/21 19:58:12 [INFO] ES version {Number:7.17.7 BuildFlavor:default BuildType:docker BuildHash:78dcaaa8cee33438b91eca7f5c7f56a70fec9e80 BuildDate:2022-10-17T15:29:54.167373105Z BuildSnapshot:false LuceneVersion:8.11.1 MinimumWireCompatibilityVersion:6.8.0 MinimumIndexCompatibilityVersion:6.0.0-beta1}: timestamp=2023-03-21T19:58:12.202+0900
elasticsearch_kibana_alert.test: Modifications complete after 0s [id=142ef070-c7d7-11ed-b07e-c199b3a60c55]
2023-03-21T19:58:12.210+0900 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2023-03-21T19:58:12.211+0900 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/phillbaker/elasticsearch/2.0.7/darwin_arm64/terraform-provider-elasticsearch_v2.0.7 pid=63108
2023-03-21T19:58:12.211+0900 [DEBUG] provider: plugin exited

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.