Skip to content

add local windows event log source #785

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: master
Choose a base branch
from

Conversation

rjury-sumo
Copy link
Collaborator

This PR adds support for a local windows events source for the installed collector. Like the local file source this is a special case as it can only be applied to existing installed collectors rather than to a hosted collector.

I don't have tests for this (the local file source doesn't either) - but have successfully been able to create or modify sources on a windows instance with installed collector installed using the two example configurations in the markdown file.

This was requested by one sumo customer and has an internal JIRA field request https://sumologic.atlassian.net/browse/FIELD-95

Closes #581

you can test vs an installed windows collector with

terraform {
  required_providers {
    sumologic = {
      source = "sumologic.com/dev/sumologic"
      version = "~> 1.0.0"
    }
  }
}

data "sumologic_collector" "installed_collector" {
  name = "terraform_source_testing"
}

resource "sumologic_local_windows_event_log_source" "local" {
  name             = "windows_logs"
  description      = "windows system and application logs in json format"
  category         = "/os/windows/events"
  collector_id     = "${data.sumologic_collector.installed_collector.id}"
  log_names  = ["System","Application","Microsoft-Windows-PowerShell/Operational", "Microsoft-Windows-TaskScheduler/Operational"]
  deny_list = "9999,7890"
 // allow_list = "1000,2000"
  event_format = 1 // 0 = XML, 1 = JSON
}

replaces PR #783

Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds support for a local Windows event log source for installed collectors in the Terraform provider. This addresses a customer request and provides the ability to configure Windows event log collection through Terraform for locally installed collectors.

Key changes include:

  • Implementation of a new resource type sumologic_local_windows_event_log_source with comprehensive configuration options
  • Support for both XML and JSON event formats with configurable filtering via allow/deny lists
  • Documentation and examples showing usage with installed collectors

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
website/docs/r/local_windows_event_source.html.markdown Comprehensive documentation with examples and parameter descriptions
sumologic/sumologic_local_windows_event_log_source.go Client API methods for CRUD operations on Windows event log sources
sumologic/resource_sumologic_local_windows_event_log_source.go Terraform resource implementation with schema and lifecycle methods
sumologic/provider.go Registration of the new resource in the provider
CHANGELOG.md Addition of changelog entry for the new feature

…ollector installation and updating argument references.
@rjury-sumo
Copy link
Collaborator Author

Hi @vsinghal13 I updated the docs as you suggested above. Do you need anything else from my side or are we just waiting for platform team review?

Copy link
Collaborator

@vsinghal13 vsinghal13 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks @rjury-sumo . QE team will be picking this up for verification soon and once verified, we can merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

local windows event log source
2 participants