使用Terraform将Azure日志分析的查询保存在(自定义)查询包中

xienkqul  于 2023-05-23  发布在  其他
关注(0)|答案(1)|浏览(213)

为了使用Terraform保存日志分析工作区的查询,我们可以使用azurerm_log_analytics_saved_search resource
但是,它似乎使用了“遗留查询”选项。

我们对带有强制性标签的资源组有一个策略,因此创建默认查询包失败,我想将查询保存到自定义查询包,是否有Terraform资源能够做到这一点?
(The atm替代方案使用Azure CLI)
最小示例:

  1. # create a resource group
  2. resource "azurerm_resource_group" "example" {
  3. name = "query-pack-tf"
  4. location = "westeurope"
  5. }
  6. # create a log analytics workspace
  7. resource "azurerm_log_analytics_workspace" "example" {
  8. name = "workspace-01"
  9. location = azurerm_resource_group.example.location
  10. resource_group_name = azurerm_resource_group.example.name
  11. }
  12. # create a query pack
  13. resource "azurerm_log_analytics_query_pack" "default" {
  14. name = "pack-test"
  15. resource_group_name = azurerm_resource_group.example.name
  16. location = "westeurope"
  17. }
  18. # A resources that uploads a query to azure - there seems to be no way to save to any query pack
  19. #-> this is the legacy way to save queries
  20. resource "azurerm_log_analytics_saved_search" "example" {
  21. name = "example-query"
  22. log_analytics_workspace_id = azurerm_log_analytics_workspace.example.id
  23. category = "Custom Logs"
  24. display_name = "Example Query"
  25. query = <<QUERY
  26. // Your query logic goes here
  27. // For example:
  28. AzureDiagnostics
  29. QUERY
  30. }
cgfeq70w

cgfeq70w1#

这可以使用azurerm_log_analytics_query_pack_query实现
如果将此代码段添加到代码示例中,它应该保存到查询包中:

  1. resource "azurerm_log_analytics_query_pack_query" "example" {
  2. name = "19952bc3-0bf9-49eb-b713-6b80e7a41847"
  3. query_pack_id = azurerm_log_analytics_query_pack.default.id
  4. body = "let newExceptionsTimeRange = 1d;\nlet timeRangeToCheckBefore = 7d;\nexceptions\n| where timestamp < ago(timeRangeToCheckBefore)\n| summarize count() by problemId\n| join kind= rightanti (\nexceptions\n| where timestamp >= ago(newExceptionsTimeRange)\n| extend stack = tostring(details[0].rawStack)\n| summarize count(), dcount(user_AuthenticatedId), min(timestamp), max(timestamp), any(stack) by problemId \n) on problemId \n| order by count_ desc\n"
  5. display_name = "Exceptions - New in the last 24 hours"
  6. }

然后,为了在日志分析中找到查询,请执行以下操作:

  • 选择查询(右上)
  • 选择'1选定'
  • 勾选所需的查询包
  • 返回日志分析界面
  • 单击下拉菜单并选择“查询类型”
  • 在“查询包”下找到您的查询包查询

展开查看全部

相关问题