Terraform escape quotes in the string don't work for DataDog Log based monitor query

Terraform Providers
1

This is a simplified Terraform code as below:

resource "datadog_monitor" "monitor_error" {
  name               = "error log"
  type               = "metric alert"
  message            = "There is error in the log."

  query = "logs(\\\"Error\\\").index(\\\"*\\\").rollup(\\\"count\\\").last(\\\"5m\\\")>0"
}

It passed when running “terraform validate”. But it failed when running “terraform apply” with the following errors.

│ Error: error validating monitor from https://api.datadoghq.com/api/v1/monitor/validate: 400 Bad Request: {"errors":["The value provided for parameter 'query' is invalid"]}
│
│   with datadog_monitor.monitor_error,
│   on main.tf line 6, in resource "datadog_monitor" "monitor_error":
│    6: resource "datadog_monitor" "monitor_error" {
│
╵

The debug output of terraform apply is as belows:

{"message":"There is error in the log.","name":"error log","options":{"include_tags":true,"new_host_delay":300,"no_data_timeframe":10,"notify_no_data":false,"require_full_window":true,"thresholds":{}},"priority":0,"query":"logs(\\\"Error\\\").index(\\\"*\\\").rollup(\\\"count\\\").last(\\\"5m\\\")\u003e0","tags":[],"type":"metric alert"}:

I also tried to use single slash, it failed the same thing. What I expect is running “terraform apply”, there is no error, monitor can be created.

2

terraform validate can only validate the correctness of the Terraform language.

It is only when you terraform apply that values actually get sent to remote APIs, which then have a chance to raise their own errors.

Terraform has faithfully taken your input and sent it to DataDog’s API, which has rejected it. Therefore you must now look for why DataDog (which I have not used) is rejecting it.

Also, I’m not sure whether DataDog is able to tolerate a trailing newline on its queries, but if it is, you may find the following Terraform syntax more comfortable to use:

  value = <<-END
    logs("Error").index("*").rollup("count").last("5m")>0
  END
3

I’m not familiar with Datadog so I’m guessing a bit here about what this query argument is supposed to be.

I see that you’ve used lots of \\\" sequences in there, which tells Terraform that it should insert a literal backslash followed by a literal quote mark.

That would mean that the raw query as seen by Datadog would be like this:

logs(\"Error\").index(\"*\").rollup(\"count\").last(\"5m\")>0

Is that the syntax Datadog actually expects? It seems weird to me for there to be backslashes in front of all of the quote marks.

4

It seems the question was edited to include additional backslashes between my answer and @apparentlymart 's answer.

5

Thanks for response.

I have tried using below also but getting same error message.

logs("Error").index("*").rollup("count").last("5m")>0

6

When i have created datadog monitor manually then its working fine. trying to create same monitor by terraform getting invalid query error.

7

Hello,

I think there is an error for value of type. Here value of type must be “log alert”

resource "datadog_monitor" "monitor_error" {
  name               = "error log"
  type               = "log alert"
  message            = "There is error in the log."

  query = <<END
    logs("Error").index("*").rollup("count").last("5m")>0
  END
}
1 Like