Skip to content

Conversation

@hashi-breed
Copy link

The REST API documentation indicates that the list of identifiers projected from the parse
expression configured in the field_extraction_rule resource. The json data for
fieldNames will contain an array of strings for each named field projection.

we added FieldNames to the the terraform schema as field_names,
extended the client, updated the acc tests, and updated docs

@hashi-breed hashi-breed requested a review from a team as a code owner July 23, 2025 23:25
@hashi-breed
Copy link
Author

hashi-breed commented Jul 23, 2025

terraform {
  required_providers {
    sumologic = {
      source = "sumologic/sumologic"
    }
  }
}
provider "sumologic" {}
data "sumologic_caller_identity" "this" {}
output "access_id" {
  value = data.sumologic_caller_identity.this.access_id
}
resource "sumologic_field_extraction_rule" "this" {
  name = "test_fer"
  scope = "_sourceHost=127.0.0.1 AND NOT _sourceCategory"
  parse_expression =<<-END_PARSE
    "sumologic" as device_vendor
    | "terraform-provider" as device_product
    | "unparsed-test" as device_facility
    | fields device_vendor,device_product,device_facility
  END_PARSE
  enabled = true
}
output "fer" {
  value = {
    name   = sumologic_field_extraction_rule.this.name
    scope  = sumologic_field_extraction_rule.this.scope
    parse  = sumologic_field_extraction_rule.this.parse_expression
    fields = sumologic_field_extraction_rule.this.field_names
  }
}

yields

fer = {
  "fields" = tolist([
    "device_vendor",
    "device_product",
    "device_facility",
  ])
  "name" = "test_fer"
  "parse" = <<-EOT
    "sumologic" as device_vendor
      | "terraform-provider" as device_product
      | "unparsed-test" as device_facility
      | fields device_vendor,device_product,device_facility
  EOT
  "scope" = "_sourceHost=127.0.0.1 AND NOT _sourceCategory"
}

@hashi-breed
Copy link
Author

separately, i'm looking into the consequences of exporting this as a computed List of String instead of a Set of String elements. i'm not sure what role tolist([]) is doing here, (or if that's normal)

  "fields" = tolist([
    "device_vendor",
    "device_product",
    "device_facility",
  ])

but changing the underlying schema to a Set of String yields much the same result, except toset([])

  "fields" = toset([
    "device_facility",
    "device_product",
    "device_vendor",
  ])

state shows it in collection agnostic representation:

resource "sumologic_field_extraction_rule" "this" {
    enabled          = true
    field_names      = [
        "device_facility",
        "device_product",
        "device_vendor",
    ]
    id               = "00000000000206B8"
    name             = "test_fer"
    parse_expression = <<-EOT
        "sumologic" as device_vendor
        | "terraform-provider" as device_product
        | "unparsed-test" as device_facility
        | fields device_vendor,device_product
    EOT
    scope            = "_sourceHost=127.0.0.1 AND NOT _sourceCategory"
}

but doesn't update state.... so we're bugged on at least that part

@ErikAtSumo
Copy link
Collaborator

@SumoLogic/tf-platform-team I've been chatting with Ryan on Slack. To run the acceptance tests, I duplicated this PR and fixed the change log here: #797. Recommend closing this one after the other is approved and merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants