-
Notifications
You must be signed in to change notification settings - Fork 123
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
The elasticstack_kibana_security_detection_rule resource's schema validation incorrectly reports that index (or data_view_id) is not set when the index value comes from a for_each loop.
The error:
Error: Invalid Configuration
with elasticstack_kibana_security_detection_rule.rules_eck,
on rules_eck.tf line 1, in resource "elasticstack_kibana_security_detection_rule" "rules_eck":
1: resource "elasticstack_kibana_security_detection_rule" "rules_eck" {
One of 'index' or 'data_view_id' must be set.
To Reproduce
- Create a YAML file with rule definition including
index:
name: Example rule
rule_id: example-rule
type: query
index:
- logs-*
query: event.code: 1116- Create Terraform configuration that reads YAML files and creates resources:
locals {
rules_dir = "./rules_eck"
rules_files = fileset(local.rules_dir, "*.yml")
rules = {
for f in local.rules_files :
f => yamldecode(file("${local.rules_dir}/${f}"))
}
}
resource "elasticstack_kibana_security_detection_rule" "rules_eck" {
for_each = local.rules
name = each.value.name
description = each.value.description
type = each.value.type
rule_id = each.value.rule_id
index = each.value.index
# this works
# index = ["logs-*"]
}- Run
terraform validate
Expected behavior
Validation should pass.
Verification shows the value exists: terraform console confirms local.rules["test_rule_eck.yml"].index contains the expected list
Debug output
n/a
Screenshots
n/a
Versions (please complete the following information):
- Provider: elasticstack (elastic/elasticstack)
- Provider Version: 0.12.2
- OS: Linux (WSL2)
Additional context
n/a
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working