Special character in string

[sam]

Hello,

I am facing an issue while adding special character (/) in String

variable event_log_names {
	default = ["Application","Microsoft-Windows-TaskScheduler/Diagnostics"]
	type= list(string)
}

resource "azurerm_log_analytics_datasource_windows_event" "example" {
	for_each =toset(var.event_log_names)
	name                = "test"
	resource_group_name = "testing_rg"
	workspace_name      = "test_law"
	event_log_name      = each.value
	event_types         = ["error"]
}

I get below error if I add “Microsoft-Windows-TaskScheduler/Diagnostics” to the list

error: invalid character ‘<’ looking for beginning of value

I have tried below things for string “Microsoft-Windows-TaskScheduler/Diagnostics”

1. ${}
2. $${}
3. \

Please let me know if I am missing something silly or if it is an provider issue…

Terraform Version : 1.0.5
Azurerm Provider : 2.76.0

[Neutrollized]

Shouldn’t it be:

type = list(string)

and

   for_each = toset(var.event_log_names)

??

In any case I don’t know if not liking the / is an Azure thing, but it works okay for GCP – I can have list of string and it won’t complain about / or needing to escape it. As for escaping stuff…off the top of my head I think it was multiple (2 or 3) backslashes to escape (although I think that was pre-1.0). You can give that a try and see if it helps (sorry, I don’t have any Azure examples on hand to try it on.

[sam]

Fixed the typo.
The code works fine without the second element (Microsoft-Windows-TaskScheduler/Diagnostics)

I have tried multiple backshlashes but it didnt help.

[Neutrollized]

Out of curiosity, if your second element was just a string like the first one (i.e. just “TaskScheduler” for example), does it give you any errors?

[sam]

Nope. It works absolutely fine for all other string.
The error pops up as soon as I add slash (/).

[Neutrollized]

So I tested it on my work laptop/account as I do have somewhat of an Azure setup on there and I’m using:

Terraform v1.0.2
AzureRM provider: v2.78.0

I’m using the following code here:

provider "azurerm" {
  features {}
}

variable "event_log_names" {
  default = ["Application", "Microsoft-Windows-TaskScheduler/Diagnostic"]
  type    = list(string)
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "Canada Central"
}

resource "azurerm_log_analytics_workspace" "example" {
  name                = "example-law"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
}

resource "azurerm_log_analytics_datasource_windows_event" "example" {
  for_each            = toset(var.event_log_names)
  name                = "example-lad-wpc"
  resource_group_name = azurerm_resource_group.example.name
  workspace_name      = azurerm_log_analytics_workspace.example.name
  event_log_name      = each.value
  event_types         = ["error"]
}

Which is basically the example here with the for_each that you have and it worked for me without any issues.

Are you able to run the code I posted above with your TF/Azure provider combination? Perhaps delete your .terraform folder and do another init?

[Neutrollized]

@sam didn’t see a response from you but was curious whether you got it resolved and what ended up being the reason. Thanks!

[sam]

Extremely sorry for the delay in response.
The issue is not yet resolved. I am able to plan but it fails while applying the changes.
I tried deleting .terraform and still did not work.

Are you able to create the resource or just get the plan for creation ?

[Neutrollized]

I can do both plan and apply (and can confirm resources created).

Are you do you have the AzureRM provider version hardcoded anywhere? What version does it pull after you delete .terraform and re-initialize?

Are you able to copy the code I posted above into a main.tf in a folder somewhere and do the terraform init, plan and apply?

(EDIT: and there’s no need to apologize )

[Neutrollized]

Oh!!! I think i know what your issue is. The code you pasted…that’s not exactly what you have right? Because the example wouldn’t really work in practice as your resource name is the just “test” so even if you have a for_each loop, they would overwrite each other and only the last datasource gets created. I assume you have a variable in the name field (i.e. name = "test-${each.value}") and that’s the part that’s giving you the error you’re seeing about invalid characters ‘<’ looking for beginning of value

@sam

resource "azurerm_log_analytics_datasource_windows_event" "example" {
	for_each =toset(var.event_log_names)
	name                = "test"
	resource_group_name = "testing_rg"
	workspace_name      = "test_law"
	event_log_name      = each.value
	event_types         = ["error"]
}

[Neutrollized]

I think you’re looking for a “map” instead of a list. So then your key can be a simple string that you can append to the name and the value can have the / that you use for event_log_name. I’ve made (and tested) the changes below, see if that resolves your issue:

provider "azurerm" {
  features {}
}

variable "event_log_names" {
  default = {a = "Application", b = "Microsoft-Windows-TaskScheduler/Diagnostic"}
  type    = map(string)
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "Canada Central"
}

resource "azurerm_log_analytics_workspace" "example" {
  name                = "example-law"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "PerGB2018"
}

resource "azurerm_log_analytics_datasource_windows_event" "example" {
  for_each            = tomap(var.event_log_names)
  name                = "example-lad-wpc-${each.key}"
  resource_group_name = azurerm_resource_group.example.name
  workspace_name      = azurerm_log_analytics_workspace.example.name
  event_log_name      = each.value
  event_types         = ["error"]
}

EDIT: here’s a screenshot of the apply:

[sam]

Yes I have a variable .
name = join("-",[“test”,each.value])

Also its not related to loop as I am able to add multiple elements in the list and all are added. The problem arises only when I add “/” in the list.

[sam]

Thank you so much for the screenshot ! I found the issue.

When I run it in loop , the name is “test-Microsoft-Windows-TaskScheduler/Diagnostic” which contains “/”

The name or the index cannot contain “/” but only the event log name can contain.
Removed “/” from name and it got resolved

[Neutrollized]

Yeah, that’s what I was trying to say earlier – that it was the name part that twas giving you the error and not the event_log_name = each.value. Anyway, I’m glad it’s resolved

@Neutrollized

I assume you have a variable in the name field (i.e. name = "test-${each.value}" ) and that’s the part that’s giving you the error you’re seeing about invalid characters ‘<’ looking for beginning of value

EDIT: and as I mentioned, if you want to be able to append a unique identifier to the name as you go through your for_each loop, you’ll probably have to use a map and use key as the unique identifier and value as your event_log_name