Datadog Log based monitor using Terraform - invalid query

Question

I am trying to create a log-based monitor using the Datadog Terraform provider.

This is a simplified Terraform code as below:

resource "datadog_monitor" "monitor_error" {
  name               = "error log"
  type               = "log alert"
  message            = "There is error in the log."

  query = "logs(\"project_id:*\").index(\"*\").rollup(\"count\").by(\"project_id\").last(\"5m\") > 0"
}

The query that I try to use is

query = "logs(\"project_id:*\").index(\"*\").rollup(\"count\").by(\"project_id\").last(\"5m\") > 0"

It passed when running "terraform validate". But it failed when running "terraform apply" with the following errors.

│ Error: error validating monitor from https://api.datadoghq.com/api/v1/monitor/validate: 400 Bad Request: {"errors":["The value provided for parameter 'query' is invalid"]}
│
│   with datadog_monitor.monitor_error,
│   on main.tf line 6, in resource "datadog_monitor" "monitor_error":
│    6: resource "datadog_monitor" "monitor_error" {

The debug output of terraform apply is as belows:

{"message":"There is error in the log.","name":"error log","options":{"include_tags":true,"new_host_delay":300,"no_data_timeframe":10,"notify_no_data":false,"require_full_window":true,"thresholds":{}},"priority":0,"query":"logs(\"Error\").index(\"*\").rollup(\"count\").last(\"5m\")\u003e0","tags":[],"type":"metric alert"}:

What I expect is when running "terraform apply", there is no error, the monitor can be created.

Answer 1

Came across this just now.. Incase you didn't solve this yet. probably you're better off using this format with no escape characters

  query   = <<EOQ
  logs("project_id:*").index("*").rollup("count").by(project_id).last("5m") > 0
  EOQ