Terraform Provider for Sumo Logic

https://github.com/sumologic/terraform-provider-sumologic
Admin
The Terraform Sumo Logic provider is a plugin for Terraform that allows for the full lifecycle...
Tokens:201,590
Snippets:1,404
Trust Score:9.5
License:MPL-2.0
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Create sumologic_app resource

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/app.html.markdown

Example configuration for the sumologic_app resource. It installs an app by specifying its UUID and version, with optional parameters map.

```hcl
resource "sumologic_app" "example_app" {
	uuid = "ceb7fac5-1127-4a04-a5b8-2e49190be3d5"
	version = "1.0.1"
	parameters = {
	    "k1": "v1",
	    "k2": "v2"
	}
}
```

--------------------------------

### Create sumologic_cse_log_mapping resource

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/cse_log_mapping.html.markdown

Creates a Sumo Logic CSE Log Mapping resource with required and optional arguments. The example configures a log mapping named "New Log Mapping" with a product GUID, record type "Audit", enabled flag, entity relation, skipped values, a field block with lookup, and a structured input block.

```hcl
resource "sumologic_cse_log_mapping" "log_mapping" {
  name = "New Log Mapping"
  product_guid = "003d35b3-3ba8-4e93-8776-e5810b4e243e"
  record_type = "Audit"
  enabled = true
  relates_entities = true
  skipped_values = ["skipped"]
  fields {
    name = "action"
    value = "action"
    value_type = "constant"
    skipped_values = ["-"]
    default_value = ""
    format = "JSON"
    case_insensitive = false
    alternate_values = ["altValue"]
    time_zone = "UTC"
    split_delimiter = ","
    split_index = "0"
    field_join = ["and"]
    join_delimiter = ""
    format_parameters = ["param"]
    lookup {
      key = "tunnel-up"
      value = "true"
    }
  }
  structured_inputs  {
    event_id_pattern = "vpn"
    log_format = "JSON"
    product = "fortinate"
    vendor = "fortinate"
  }
}
```

--------------------------------

### Full Example with AWS asset creation

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/kinesis_metrics_source.html.markdown

Full Terraform example creating a Sumologic Kinesis Metrics source and the required AWS Kinesis Firehose, IAM roles, and CloudWatch metric stream. Includes placeholder values for account ID, AWS credentials, and region, with commented include_filter examples for AWS namespaces.

```hcl
terraform {
  required_providers {
    sumologic = {
      source = "sumologic/sumologic"
    }
    aws = {
      source = "hashicorp/aws"
    }
  }
}

provider "sumologic" {}
provider "aws" {}

locals {
  account_id = ""
  aws_access_key = ""
  aws_secret_key = ""

  description = "update your terraform description here"
  identifier = "SumologicMetricStream"

  region = "us-west-2"

  tagfilters = [
    { type = "TagFilters", namespace = "AWS/ApplicationELB", tags = ["Deployment=prod"] },
  ]

}

resource "sumologic_collector" "collector_for_kinesis_metrics" {
  name = "AWS Metrics via Kinesis"
}

resource "sumologic_kinesis_metrics_source" "kinesis_source" {
  name          = "CloudWatch Metrics via Kinesis"
  description   = "Description for Sumologic source"
  category      = "aws/cloudwatch"
  content_type  = "KinesisMetric"
  collector_id  = sumologic_collector.collector_for_kinesis_metrics.id

  authentication {
    type = "S3BucketAuthentication"
    access_key = local.aws_access_key
    secret_key = local.aws_secret_key
  }

  path {
    type = "KinesisMetricPath"

    dynamic "tag_filters" {
      for_each = local.tagfilters
      content {
        type      = tag_filters.value.type
        namespace = tag_filters.value.namespace
        tags      = tag_filters.value.tags
      }
    }
  }
}

// ------------------------------------ AWS Kinesis part

resource "aws_cloudwatch_metric_stream" "main" {
  name          = local.identifier
  role_arn      = aws_iam_role.metric_stream_to_firehose.arn
  firehose_arn  = aws_kinesis_firehose_delivery_stream.kinesis_stream.arn
  output_format = "opentelemetry0.7"

// Edit and uncomment below lines to add include_filter (or exclude_filter on similar lines)
//  include_filter {
//    namespace = "AWS/ApplicationELB"
//  }
//  include_filter {
//    namespace = "AWS/DynamoDB"
//  }

}

resource "aws_iam_role" "metric_stream_to_firehose" {
  name = "${local.identifier}-stream_to_firehose"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "streams.metrics.cloudwatch.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "metric_stream_to_firehose" {
  name = "default"
  role = aws_iam_role.metric_stream_to_firehose.id

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "firehose:PutRecord",
                "firehose:PutRecordBatch"
            ],
            "Resource": "${aws_kinesis_firehose_delivery_stream.kinesis_stream.arn}"
        }
    ]
}
EOF
}

resource "aws_iam_role" "firehose_role" {
  name = "${local.identifier}_firehose"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "firehose.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy" "firehose_can_log_errors_to_Cloudwatch" {
  role = aws_iam_role.firehose_role.id

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:${local.region}:${local.account_id}:log-group:/aws/kinesisfirehose/${local.identifier}:*",
                "arn:aws:logs:${local.region}:${local.account_id}:log-group:/aws/kinesisfirehose/${local.identifier}:*:log-stream:*"
            ]
        }
    ]
}
EOF
}

resource "aws_iam_role_policy" "firehose_can_use_s3_bucket_for_failures" {
  role = aws_iam_role.firehose_role.id

```

--------------------------------

### Example Scheduled Search with Email Notification

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/content.html.markdown

Creates a sumologic_content resource that configures a scheduled search with an email notification. The example uses the sumologic_personal_folder data source to get the parent folder ID and sets the config to a JSON-encoded SavedSearchWithScheduleSyncDefinition. The schedule runs hourly with a 15-minute time range and sends email notifications to ops@acme.org. Note the recommendation to reduce Terraform parallelism to 2 when working with many content items to avoid rate limiting.

```hcl
data "sumologic_personal_folder" "personalFolder" {}

resource "sumologic_content" "test" {
    parent_id = "${data.sumologic_personal_folder.personalFolder.id}"
    config = jsonencode({
        "type": "SavedSearchWithScheduleSyncDefinition",
        "name": "Scheduled Search with Email Notificiation Test",
        "search": {
            "queryText": "\"warn\"",
            "defaultTimeRange": "-15m",
            "byReceiptTime": false,
            "viewName": "",
            "viewStartTime": "2025-01-01T00:00:00Z",
            "queryParameters": [],
            "parsingMode": "Manual"
        },
        "searchSchedule": {
            "cronExpression": "0 0 * * * ? *",
            "displayableTimeRange": "-10m",
            "parseableTimeRange": {
                "type": "BeginBoundedTimeRange",
                "from": {
                    "type": "RelativeTimeRangeBoundary",
                    "relativeTime": "-50m"
                },
                "to": null
            },
            "timeZone": "America/Los_Angeles",
            "threshold": {
                "operator": "gt",
                "count": 0
            },
            "notification": {
                "taskType": "EmailSearchNotificationSyncDefinition",
                "toList": ["ops@acme.org"],
                "subjectTemplate": "Search Results: {{Name}}",
                "includeQuery": true,
                "includeResultSet": true,
                "includeHistogram": false,
                "includeCsvAttachment": false
            },
            "scheduleType": "1Hour",
            "muteErrorEmails": false,
            "parameters": []
        },
        "description": "Runs every hour with timerange of 15m and sends email notifications"
    })
}
```

--------------------------------

### Create a local file source with an installed collector

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/local_file_source.html.markdown

Defines an installed collector and a local file source that references it. The source collects logs matching the path expression `/Applications/Sumo Logic Collector/logs/*.log.*`.

```hcl
resource "sumologic_installed_collector" "installed_collector" {
  name       = "test-collector"
  category   = "macos/test"
  ephemeral  = true
}

resource "sumologic_local_file_source" "local" {
  name             = "localfile-mac"
  description      = "test"
  category         = "test"
  collector_id     = "${sumologic_installed_collector.installed_collector.id}"
  path_expression  = "/Applications/Sumo Logic Collector/logs/*.log.*"
}
```

--------------------------------

### Create a Sumologic CSE Context Action

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/cse_context_action.html.markdown

Creates a Sumologic CSE Context Action resource with a URL template. The example sets the name, type, template, IOC types, entity types, record fields, and enables the action.

```hcl
resource "sumologic_cse_context_action" "context_action" {
	name = "Context Action Name"
	type = "URL"
	template = "https://bar.com/?q={{value}}"
	ioc_types = ["IP_ADDRESS"]
	entity_types = ["_hostname"]
	record_fields = ["request_url"]
	all_record_fields = false	
	enabled = true	
}

```

--------------------------------

### Create a Sumologic Dashboard with text, collapsible, and search panels

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/dashboard.html.markdown

Use this example to create a Sumologic dashboard with a text panel, a collapsible panel, and a metrics search panel. The configuration sets the dashboard title, description, folder, refresh interval, theme, time range, topology labels, and domain. It includes a log query for API errors and a metrics query for 5xx responses, with visual settings for pie chart and stacked area chart.

```hcl
data "sumologic_personal_folder" "personalFolder" {}

resource "sumologic_dashboard" "api-dashboard" {
	title = "Api Health Dashboard"
	description = "Demo dashboard description"
	folder_id = data.sumologic_personal_folder.personalFolder.id
	refresh_interval = 120
	theme = "Dark"

	time_range {
		begin_bounded_time_range {
            from {
                literal_time_range {
                    range_name = "today"
                }
            }
        }
	}

	topology_label_map {
		data {
			label = "cluster"
			values = ["api-prod"]
		}
		data {
			label = "namespace"
			values = ["default"]
		}
	}

	domain = "app"

	## text panel
	panel {
		text_panel {
			key = "text-panel-01"
			title = "Api Health"
			visual_settings = jsonencode(
				{
					"text": {
						"verticalAlignment": "top",
						"horizontalAlignment": "left",
						"fontSize": 12
					}
				}
			)
			keep_visual_settings_consistent_with_parent = true
			text = <<-EOF
				## Api Health Monitoring

				Use this dashboard to monitor API service health. It contains following panels:

				1. API errors: Errors in last 12 hours
				3. API 5xx: Count of 5xx response
				3. CPU utilization: CPU utilization in last 60 mins
			EOF
		}
	}

	## collapsible panel
	panel {
		collapsible_panel {
			key = "collapsible-panel-01"
			title = "API Metrics"
			collapsed = false
			collapsible_panel_child_keys = ["search-panel-01", "metrics-panel-01"]
			keep_visual_settings_consistent_with_parent = true
		}
	}

	## search panel - log query
	panel {
		sumo_search_panel {
			key = "search-panel-01"
			title = "Api Errors by Host"
			description = "Errors in api service since last 12 hours"
			# stacked time series
			visual_settings = jsonencode(
				{
					"general": {
							"mode": "timeSeries",
							"type": "area",
							"displayType": "stacked",
							"markerSize": 5,
							"lineDashType": "solid",
							"markerType": "square",
							"lineThickness": 1
						},
						"title": {
								"fontSize": 14
						},
						"legend": {
								"enabled": true,
								"verticalAlign": "bottom",
								"fontSize": 12,
								"maxHeight": 50,
								"showAsTable": false,
								"wrap": true
						}
					}
				)
			keep_visual_settings_consistent_with_parent = true
			query {
				query_string = "_sourceCategory=api error | timeslice 1h | count by _timeslice, _sourceHost | transpose row _timeslice column _sourceHost"
				query_type = "Logs"
				query_key = "A"
			}
			time_range {
				begin_bounded_time_range {
					from {
						relative_time_range {
							relative_time = "-12h"
						}
					}
				}
			}
		}
	}

	## search panel - metrics query
	panel {
		sumo_search_panel {
			key = "metrics-panel-01"
			title = "Api 5xx Response Count"
			description = "Count of 5xx response from api service"
			# pie chart
			visual_settings = jsonencode(
				{
					"general": {
							"mode": "distribution",
							"type": "pie",
							"displayType": "default",
							"fillOpacity": 1,
							"startAngle": 270,
							"innerRadius": "40%",
							"maxNumOfSlices": 10,
							"aggregationType": "sum"
						},
						"title": {
							"fontSize": 14
						},
					}
				)
			keep_visual_settings_consistent_with_parent = true
			query {
				query_string = "_sourceCategory=api metric=Api-5xx"
				query_type = "Metrics"
				query_key = "A"
				metrics_query_mode = "Advanced"
			}
			time_range {
				begin_bounded_time_range {
					from {
						literal_time_range {
							range_name = "today"
						}
					}
				}
			}
		}
	}
```

--------------------------------

### Import sumologic_log_search

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/log_search.html.markdown

Imports a log search using its identifier. The example shows the command with the resource address and the ID '0000000007FFD79D'.

```hcl
terraform import sumologic_log_search.example_search 0000000007FFD79D
```

--------------------------------

### Example Usage: sumologic_policies resource

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/policies.html.markdown

Defines a sumologic_policies resource with all required arguments. The user_concurrent_sessions_limit block is required and max_concurrent_sessions defaults to 100. Only one instance of this resource should be defined per organization.

```hcl
resource "sumologic_policies" "example_policies" {
  audit = false
  data_access_level = false
  max_user_session_timeout = "7d"
  search_audit = false
  share_dashboards_outside_organization = false
  user_concurrent_sessions_limit {
    enabled = false
    max_concurrent_sessions = 100
  }
}
```

--------------------------------

### Retrieve Personal Folder with sumologic_personal_folder data source

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/d/personal_folder.html.markdown

Use this HCL data source to retrieve the SumoLogic Personal Folder. The example declares a data source named `personalFolder` with no required arguments. After applying, the exported attributes `id`, `name`, and `description` are available.

```hcl
data "sumologic_personal_folder" "personalFolder" {}

```

--------------------------------

### Create SLO folder and SLO in it

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/slo_folder.html.markdown

Creates an SLO folder and then an SLO inside it. The SLO's parent_id references the folder's id. The example is truncated with '...' in the source.

```hcl
resource "sumologic_slo_folder" "tf_slo_folder" {
  name        = "slo-tf-folder"
  description = "folder for SLO created for testing"
  parent_id   = "0000000000000001"
}

resource "sumologic_slo" "slo_tf_test" {
  name        = "slo-tf-test1"
  description = "example SLO created for testing"
  parent_id   = sumologic_slo_folder.slo_tf_test_folder.id
 ...
}

```

--------------------------------

### Import sumologic_metrics_search by ID

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/metrics_search.html.markdown

Imports an existing metrics search into Terraform state using its identifier. Replace the example ID with the actual resource ID.

```hcl
terraform import sumologic_metrics_search.example_search 0000000007FFD79D
```

--------------------------------

### Create Data Forwarding Rule for Partition

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/data_forwarding_rule.html.markdown

Example usage for creating a data forwarding rule for a partition. The partition resource is defined first, and the rule references its id via `sumologic_partition.test_partition.id`. The rule uses `payload_schema = "builtInFields"` and `format = "json"`.

```hcl
resource "sumologic_partition" "test_partition" {
  name               = "testing_rule_partitions"
  routing_expression = "_sourcecategory=abc/Terraform"
  is_compliant       = false
  retention_period   = 30
  analytics_tier     = "flex"
}

resource "sumologic_data_forwarding_rule" "example_data_forwarding_rule" {
  index_id = sumologic_partition.test_partition.id
  destination_id = "00000000000732AA"
  enabled = true
  file_format = "test/{index}/{day}/{hour}/{minute}"
  payload_schema = "builtInFields"
  format = "json"
}
```

--------------------------------

### Look up Sumo Logic collector by name or id

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/d/collector.html.markdown

Two data source examples showing lookup by name and by id. If both id and name are specified, id takes precedence.

```hcl
data "sumologic_collector" "this" {
  name = "MyCollector"
}
```

```hcl
data "sumologic_collector" "that" {
  id = "1234567890"
}
```

--------------------------------

### Create sumologic_cloudwatch_source with AWSRoleBasedAuthentication

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/cloudwatch_source.html.markdown

Creates a Sumologic CloudWatch source with AWS role-based authentication and a CloudWatch path. The example defines local filters and tag filters, then uses them in a dynamic block. It also creates a collector resource that the source references. AWS credentials are stored in plain text in the state, which is a security concern.

```hcl
locals {
  filters = [{
    name        = "Exclude Comments"
    filter_type = "Exclude"
    regexp      = "#.*"
  }] 
  tagfilters = [{
          "type" = "TagFilters"
          "namespace" = "All"
          "tags" = ["k3=v3"]
        },{
          "type" = "TagFilters"
          "namespace" = "AWS/Route53"
          "tags" = ["k1=v1"]
        },{
          "type" = "TagFilters"
          "namespace" = "AWS/S3"
          "tags" = ["k2=v2"]
        }]
}

resource "sumologic_cloudwatch_source" "terraform_cloudwatch_source" {
  name          = "CloudWatch Metrics"
  description   = "My description"
  category      = "aws/terraform_cw"
  content_type  = "AwsCloudWatch"
  scan_interval = 300000
  paused        = false
  collector_id  = "${sumologic_collector.collector.id}"

  authentication {
    type = "AWSRoleBasedAuthentication"
    role_arn = "arn:aws:iam::01234567890:role/sumo-role"
  }

  path {
    type = "CloudWatchPath"
    limit_to_regions = ["us-west-2"]
    limit_to_namespaces = ["AWS/Route53","AWS/S3","customNamespace"]
  
    dynamic "tag_filters" {
    for_each = local.tagfilters
    content {
      type = tag_filters.value.type
      namespace = tag_filters.value.namespace
      tags = tag_filters.value.tags
    }
  }

  }
}

resource "sumologic_collector" "collector" {
  name        = "my-collector"
  description = "Just testing this"
}
```

--------------------------------

### Look up CSE log mapping vendor product with product and vendor

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/d/cse_log_mapping_vendor_product.markdown

Defines a data source for the Sumo Logic CSE log mapping vendor product. Both `product` and `vendor` are mandatory; if not provided, an error is generated. The exported `guid` can be used in another Terraform stack.

```hcl
data "sumologic_cse_log_mapping_vendor_product" "web_gateway" {
  product = "Web Gateway"
  vendor = "McAfee"
}
```

--------------------------------

### Retrieve Admin Recommended Folder and create a folder under it

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/d/admin_recommended_folder.html.markdown

Configure the Sumo Logic provider in admin mode, retrieve the Admin Recommended Folder data source, and create a folder under it. Requires admin_mode = true and an alias for the provider to use in the resource.

```hcl
# Configure the Sumo Logic Provider in Admin Mode
provider "sumologic" {
  ...
  admin_mode  = true
  alias       = "admin"
}

# Look up the Admin Recommended Folder
data "sumologic_admin_recommended_folder" "folder" {}

# Create a folder underneath the Admin Recommended Folder (which requires Admin Mode)
resource "sumologic_folder" "test" {
  provider    = sumologic.admin
  name        = "test"
  description = "A test folder"
  parent_id   = data.sumologic_admin_recommended_folder.folder.id
}

```

--------------------------------

### Create sumologic_saml_configuration resource

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/saml_configuration.html.markdown

Creates a Sumo Logic SAML configuration resource with all supported arguments, including on-demand provisioning settings. Required arguments are configuration_name, issuer, x509cert1, and on_demand_provisioning_roles; all others are optional with documented defaults.

```hcl
resource "sumologic_saml_configuration" "exampleSamlConfiguration" {
  sp_initiated_login_path = ""
  configuration_name = "SumoLogic"
  issuer = "http://www.okta.com/abxcseyuiwelflkdjh"
  sp_initiated_login_enabled = false
  authn_request_url = ""
  x509cert1 = "string"
  x509cert2 = ""
  x509cert3 = ""
  on_demand_provisioning_enabled {
    first_name_attribute = "firstName"
    last_name_attribute = "lastName"
    on_demand_provisioning_roles = ["Administrator"]
  }
  roles_attribute = "Administrator"
  logout_enabled = false
  logout_url = ""
  email_attribute = ""
  debug_mode = false
  sign_authn_request = false
  disable_requested_authn_context = false
  is_redirect_binding = false
}
```

--------------------------------

### Build provider and run acceptance tests

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/README.md

Shell commands for building the provider from source, setting environment variables for acceptance tests, and running acceptance tests. Useful for developers contributing to the provider.

```sh
sh
$ git clone https://github.com/SumoLogic/terraform-provider-sumologic.git
$ cd terraform-provider-sumologic
$ make build
```

```sh
$ export SUMOLOGIC_ACCESSID="yourAccessID"
$ export SUMOLOGIC_ACCESSKEY="yourAccessKey"
$ export SUMOLOGIC_ENVIRONMENT="yourEnvironment"
$ export SUMOLOGIC_BASE_URL="yourEnvironmentAPIUrl"  # not required for most production deployments
$ export TF_ACC=1
```

```sh
sh
# Run all acceptance tests:
$ make testacc
# Run a specific test:
$ go test -v ./sumologic  -run YourSpecificTestName
```

--------------------------------

### Create a Sumologic Field

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/field.html.markdown

Defines a Sumologic field resource. The first example creates an enabled field named 'mystring'. The second example creates a field named 'my_other_string' with state 'Disabled'.

```hcl
resource "sumologic_field" "field" {
  field_name = "mystring"
}

resource "sumologic_field" "field" {
  field_name = "my_other_string"
  state      = "Disabled"
}
```

--------------------------------

### Set Sumo Logic environment variables and run terraform plan

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/index.html.markdown

Use these shell commands to export the required environment variables (SUMOLOGIC_ACCESSID, SUMOLOGIC_ACCESSKEY, SUMOLOGIC_ENVIRONMENT) and then run terraform plan. The provider will use these credentials for authentication.

```bash
$ export SUMOLOGIC_ACCESSID="your-access-id"
$ export SUMOLOGIC_ACCESSKEY="your-access-key"
$ export SUMOLOGIC_ENVIRONMENT=us2
$ terraform plan
```

--------------------------------

### Basic async AWS Lambda invocation

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/async_aws_lambda_invocation.html.markdown

Basic example of the sumologic_async_aws_lambda_invocation resource. It invokes an AWS Lambda function asynchronously using the Event invocation type, so Terraform does not wait for completion. The example sets function_name, region, aws_profile, input, and qualifier.

```hcl
resource "sumologic_async_aws_lambda_invocation" "trigger_setup" {
  function_name = "MySetupFunction"
  region        = "us-east-1"
  aws_profile   = "my-aws-profile"
  input         = jsonencode({ env = "production" })
  qualifier     = "$LATEST"
}

```

--------------------------------

### Create a CSE Rule Tuning Expression

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/cse_rule_tuning_expression.html.markdown

Use this example to create a CSE Rule Tuning Expression resource. The example sets the name, description, expression, enabled, exclude, is_global, and rule_ids arguments. The expression matches records where accountId equals 1234, and the exclude flag is set to true to exclude matching records.

```hcl
resource "sumologic_cse_rule_tuning_expression" "rule_tuning_expression" {
  name = "New Rule Tuning Name"
  description = "New Rule Tuning Description"
  expression = "accountId = 1234"
  enabled = "true"
  exclude = "true"
  is_global = "false"
  rule_ids = ["LEGACY-S00084"]
}
```

--------------------------------

### Import sumologic_installed_collector by name

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/installed_collector.html.markdown

Imports an installed collector using its unique collector name per Sumo Logic account.

```hcl
terraform import sumologic_installed_collector.test my_test_collector
```

--------------------------------

### Import sumologic_installed_collector by ID

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/installed_collector.html.markdown

Imports an installed collector using its collector ID. The ID is the internal ID of the collector and can be used to attach sources.

```hcl
terraform import sumologic_installed_collector.test 1234567890
```

--------------------------------

### Create a Sumo Logic folder

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/folder.html.markdown

Creates a Sumo Logic folder with a unique name and description, using the personal folder as the parent. The parent_id is required and the data source retrieves the ID of the personal folder.

```hcl
data "sumologic_personal_folder" "personalFolder" {}

resource "sumologic_folder" "folder" {
  name        = "test-folder"
  description = "A test folder"
  parent_id   = "${data.sumologic_personal_folder.personalFolder.id}"
}
```

--------------------------------

### Create Sumo Logic Logs Monitor with FGP and Roles

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/monitor.html.markdown

Creates two Sumo Logic roles with monitor permissions and a logs monitor that references those roles for Fine Grain Permissions (FGP). The monitor includes a static condition, email and webhook notifications, and two obj_permission blocks granting Read/Update to one role and Read to the other.

```hcl
resource "sumologic_role" "tf_test_role_01" {
  name        = "tf_test_role_01"
  description = "Testing resource sumologic_role"
  capabilities = [
    "viewAlerts",
    "viewMonitorsV2",
    "manageMonitorsV2"
  ]
}
resource "sumologic_role" "tf_test_role_02" {
  name        = "tf_test_role_02"
  description = "Testing resource sumologic_role"
  capabilities = [
    "viewAlerts",
    "viewMonitorsV2",
    "manageMonitorsV2"
  ]
}
resource "sumologic_monitor" "tf_logs_monitor_1" {
  name         = "Terraform Logs Monitor"
  description  = "tf logs monitor"
  type         = "MonitorsLibraryMonitor"
  is_disabled  = false
  content_type = "Monitor"
  monitor_type = "Logs"
  evaluation_delay = "5m"
  query_time_type = "searchableTime"
  tags = {
    "team" = "monitoring"
    "application" = "sumologic"
  }

  queries {
    row_id = "A"
    query  = "_sourceCategory=event-action info"
  }

  trigger_conditions {
    logs_static_condition {
      critical {
        time_range = "15m"
        frequency = "5m"
        alert {
          threshold      = 40.0
          threshold_type = "GreaterThan"
        }
        resolution {
          threshold      = 40.0
          threshold_type = "LessThanOrEqual"
        }
      }
    }
  }

  notifications {
    notification {
      connection_type = "Email"
      recipients = [
        "abc@example.com",
      ]
      subject      = "Monitor Alert: {{TriggerType}} on {{Name}}"
      time_zone    = "PST"
      message_body = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}"
    }
    run_for_trigger_types = ["Critical", "ResolvedCritical"]
  }
  notifications {
    notification {
      connection_type = "Webhook"
      connection_id   = "0000000000ABC123"
    }
    run_for_trigger_types = ["Critical", "ResolvedCritical"]
  }
  playbook = "{{Name}} should be fixed in 24 hours when {{TriggerType}} is triggered."
  alert_name = "Alert {{ResultJson.my_field}} from {{Name}}"
  notification_group_fields = ["_sourceHost"]
  obj_permission {
    subject_type = "role"
    subject_id = sumologic_role.tf_test_role_01.id
    permissions = ["Read","Update"]
  }
  obj_permission {
    subject_type = "role"
    subject_id = sumologic_role.tf_test_role_02.id
    permissions = ["Read"]
  }
}
```

--------------------------------

### Import a Metrics Search V2

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/metrics_search_v2.html.markdown

Imports an existing sumologic_metrics_search_v2 resource using its identifier. The example shows the terraform import command with a sample ID.

```hcl
terraform import sumologic_metrics_search_v2.example_search 0000000007FFD79D
```

--------------------------------

### Create a Sumo Logic Metrics Monitor with Static Conditions

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/monitor.html.markdown

Creates a Sumo Logic metrics monitor with static trigger conditions for critical and warning thresholds, email notifications, and a playbook. The monitor queries CPU metrics and includes evaluation delay, tags, and notification grouping fields.

```hcl
resource "sumologic_monitor" "tf_metrics_monitor_1" {
  name         = "Terraform Metrics Monitor"
  description  = "tf metrics monitor"
  type         = "MonitorsLibraryMonitor"
  is_disabled  = false
  content_type = "Monitor"
  monitor_type = "Metrics"
  evaluation_delay = "1m"
  tags = {
    "team" = "monitoring"
    "application" = "sumologic"
  }

  queries {
    row_id = "A"
    query  = "metric=CPU* _sourceCategory=event-action"
  }

  trigger_conditions {
    metrics_static_condition {
      critical {
        time_range = "15m"
        occurrence_type = "Always"
        alert {
          threshold      = 40.0
          threshold_type = "GreaterThan"
          min_data_points = 5
        }
        resolution {
          threshold      = 40.0
          threshold_type = "LessThanOrEqual"
          min_data_points = 5
        }
      }
      warning {
        time_range = "30m"
        occurrence_type = "Always"
        alert {
          threshold      = 30.0
          threshold_type = "GreaterThan"
          min_data_points = 3
        }
        resolution {
          threshold      = 30.0
          threshold_type = "LessThanOrEqual"
          min_data_points = 3
          occurrence_type = "AtLeastOnce"
        }
      }
    }
  }

  notifications {
    notification {
      connection_type = "Email"
      recipients      = ["abc@example.com"]
      subject         = "Triggered {{TriggerType}} Alert on Monitor {{Name}}"
      time_zone       = "PST"
      message_body    = "Triggered {{TriggerType}} Alert on {{Name}}: {{QueryURL}}"
    }
    run_for_trigger_types = ["Critical", "ResolvedCritical"]
  }
  playbook = "test playbook"
  notification_group_fields = ["metric"]
}
```

--------------------------------

### Import content permissions with terraform import

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/content_permission.html.markdown

Imports permissions for a content item using its content identifier. The example shows importing with identifier 0000000008E0183E.

```hcl
// import permissions for content item with identifier = 0000000008E0183E
terraform import sumologic_content_permission.dashboard_permission_import 0000000008E0183E
```

--------------------------------

### O365 SharePoint Audit Source

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/o365_audit_source.html.markdown

Creates a Sumologic O365 audit source for SharePoint audit logs. Uses the same collector and authentication variables as the Exchange example.

```hcl
resource "sumologic_o365_audit_source" "sharepoint_audit" {
  name         = "o365-sharepoint-audit"
  description  = "O365 SharePoint Audit Logs"
  category     = "o365/sharepoint"
  collector_id = sumologic_collector.o365_collector.id

  third_party_ref {
    resources {
      service_type = "O365AuditNotification"

      path {
        type     = "O365NotificationPath"
        workload = "Audit.SharePoint"
        region   = "Commercial"
      }

      authentication {
        type          = "O365AppRegistrationAuthentication"
        tenant_id     = var.o365_tenant_id
        client_id     = var.o365_client_id
        client_secret = var.o365_client_secret
      }
    }
  }
}
```

--------------------------------

### Create nested monitor folders with role permissions

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/monitor_folder.html.markdown

Creates two roles and a root monitor folder, then creates a production sub-folder with explicit permissions for those roles. Monitor folders allow up to six levels of sub-folders. The `obj_permission` blocks control explicit permissions, not inherited ones.

```hcl
resource "sumologic_role" "tf_test_role_01" {
  name        = "tf_test_role_01"
  description = "Testing resource sumologic_role"
  capabilities = [
    "viewAlerts",
    "viewMonitorsV2",
    "manageMonitorsV2"
  ]
}

resource "sumologic_role" "tf_test_role_02" {
  name        = "tf_test_role_02"
  description = "Testing resource sumologic_role"
  capabilities = [
    "viewAlerts",
    "viewMonitorsV2",
    "manageMonitorsV2"
  ]
}

resource "sumologic_monitor_folder" "tf_security_team_root_folder" {
  name        = "Security Team Monitors"
  description = "Monitors used by the Security Team."
}

resource "sumologic_monitor_folder" "tf_security_team_prod_folder" {
  name        = "Production Monitors"
  description = "Monitors for the Security Team Production Environment."
  parent_id   = sumologic_monitor_folder.tf_security_team_root_folder.id
  obj_permission {
    subject_type = "role"
    subject_id = sumologic_role.tf_test_role_01.id 
    permissions = ["Create","Read","Update"] 
  }
  obj_permission {
    subject_type = "role"
    subject_id = sumologic_role.tf_test_role_02.id
    permissions = ["Create", "Read"]
  }
}

resource "sumologic_monitor_folder" "tf_security_team_stag_folder" {
  name        = "Staging Monitors"
  description = "Monitors for the Security Team Staging Environment."
  parent_id   = sumologic_monitor_folder.tf_security_team_root_folder.id
```

--------------------------------

### Import Sumo Logic Dashboard

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/dashboard.html.markdown

Imports an existing Sumo Logic dashboard into Terraform state using its dashboard ID. The ID is the unique identifier of the dashboard, as shown in the example.

```hcl
terraform import sumologic_dashboard.example-dashboard q0IKwAK5t2qRI4sgiANwnS87k5S4twN2sCpTuZFSsz6ZmbENPsG7PnpqZygc
```

--------------------------------

### Configure Sumo Logic Provider and Create Resources

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/index.html.markdown

Terraform configuration that sets up the provider with access credentials, creates a collector and HTTP source, and demonstrates admin mode with a folder resource. Requires the sumologic provider version and Terraform >= 0.13.

```hcl
terraform {
    required_providers {
        sumologic = {
            source = "sumologic/sumologic"
            version = "" # set the Sumo Logic Terraform Provider version
        }
    }
    required_version = ">= 0.13"
}

# Setup authentication variables. See "Authentication" section for more details.
variable "sumologic_access_id" {
    type = string
    description = "Sumo Logic Access ID"
}
variable "sumologic_access_key" {
    type = string
    description = "Sumo Logic Access Key"
    sensitive = true
}

# Configure the Sumo Logic Provider
provider "sumologic" {
    access_id   = "${var.sumologic_access_id}"
    access_key  = "${var.sumologic_access_key}"
    environment = "us2"
}

# Create a collector
resource "sumologic_collector" "collector" {
    name = "MyCollector"
}

# Create a HTTP source
resource "sumologic_http_source" "http_source" {
    name         = "http-source"
    category     = "my/source/category"
    collector_id = "${sumologic_collector.collector.id}"
}

# Configure the Sumo Logic Provider in Admin Mode
provider "sumologic" {
    access_id   = "${var.sumologic_access_id}"
    access_key  = "${var.sumologic_access_key}"
    environment = "us2"
    admin_mode  = true
    alias       = "admin"
}

# Look up the Admin Recommended Folder
data "sumologic_admin_recommended_folder" "folder" {}

# Create a folder underneath the Admin Recommended Folder (which requires Admin Mode)
resource "sumologic_folder" "test" {
    provider    = sumologic.admin
    name        = "test"
    description = "A test folder"
    parent_id   = data.sumologic_admin_recommended_folder.folder.id
}

```

--------------------------------

### Create a Sumo Logic Lookup Table

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/lookup_table.html.markdown

Creates a Sumo Logic lookup table resource. Requires a personal folder data source for the parent folder ID. The content argument loads a CSV file; note that the first row must be a header matching field names, and uploading replaces all existing rows.

```hcl
data "sumologic_personal_folder" "personalFolder" {}

resource "sumologic_lookup_table" "lookupTable" {
    name = "Sample Lookup Table"
    fields {
      field_name = "FieldName1"
      field_type = "boolean"
    }
    fields {
      field_name = "FieldName2"
          field_type = "string"
    }
    ttl               = 100
    primary_keys      = ["FieldName1"]
    parent_folder_id  = "${data.sumologic_personal_folder.personalFolder.id}"
    size_limit_action = "DeleteOldData"
    description       = "some description"
    content           = file("${path.module}/lookup.csv")
}
```

--------------------------------

### Create sumologic_source_template resource

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/source_template.html.markdown

Creates a Sumo Logic source template resource with a schema reference, selector, and input JSON configuration. The input_json defines a hostmetrics receiver and a resource processor with user and default attributes.

```hcl
resource "sumologic_source_template" "example_source_template" {
    schema_ref {
        type = "Mac"
    }
    selector {
        tags =  [
             [
                {
                key = "new1"
                values =  ["Abc","Abc2"]
                }
             ]
        ]
        names = ["TestCollector1"]
    }
    is_enabled = true
    input_json = jsonencode({
        "name": "hostmetrics_test_source_template_test",
        "description": "Host metric source" ,
        "receivers": {
            "hostmetrics": {
                "receiverType": "hostmetrics",
                "collection_interval": "5m",
                "cpu_scraper_enabled": true,
                "disk_scraper_enabled": true,
                "load_scraper_enabled": true,
                "filesystem_scraper_enabled": true,
                "memory_scraper_enabled": true,
                "network_scraper_enabled": true,
                "processes_scraper_enabled": true,
                "paging_scraper_enabled": true
            }
        },
        "processors": {
            "resource": {
                "processorType": "resource",
                "user_attributes": [
                    {
                        "key": "_sourceCategory",
                        "value": "otel/host"
                    }
                ],
                "default_attributes": [
                    {
                        "key": "sumo.datasource",
                        "value": "apache"
                    },
                    {
                        "key": "host.name",
                        "value": "host1"
                    },
                    {
                        "key": "host.id",
                        "value": "hostid"
                    },
                    {
                        "key": "log.file.path",
                        "value": "filePath"
                    }
                ]
            }
        }
    })
}
```

--------------------------------

### Multi-profile async AWS Lambda invocation

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/async_aws_lambda_invocation.html.markdown

Multi-profile example of the sumologic_async_aws_lambda_invocation resource. It uses a different AWS profile (prod-account) and region (us-west-2) to invoke a Lambda function asynchronously.

```hcl
resource "sumologic_async_aws_lambda_invocation" "cross_account" {
  function_name = "SetupFunction"
  region        = "us-west-2"
  aws_profile   = "prod-account"
  input         = jsonencode({ source = "terraform" })
}

```

--------------------------------

### Create a CSE First Seen Rule

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/cse_first_seen_rule.html.markdown

Defines a sumologic_cse_first_seen_rule resource with baseline type PER_ENTITY, entity selectors for username and hostname, and various rule settings. Required arguments include baseline_type, baseline_window_size, description_expression, enabled, entity_selectors, filter_expression, name, name_expression, retention_window_size, severity, and value_fields.

```hcl
resource "sumologic_cse_first_seen_rule" "first_seen_rule" {
  baseline_type          = "PER_ENTITY"
  baseline_window_size   = "35000"
  description_expression = "First User Login - {{ user_username }}"
  enabled                = true

  entity_selectors {
        entity_type = "_username"
        expression = "user_username"
  }

  entity_selectors {
        entity_type = "_hostname"
        expression = "dstDevice_hostname"
  }

  filter_expression     = "objectType=\"Network\""
  group_by_fields       = ["user_username"]
  is_prototype          = false
  name                  = "First User Login"
  name_expression       = "First User Login - {{ user_username }}"
  retention_window_size = "86400000"
  severity              = 1
  value_fields          = ["dstDevice_hostname"]
  suppression_window_size = 2100000
}
```

--------------------------------

### Create a scan budget resource

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/scan_budget.html.markdown

Defines a `sumologic_scan_budget` resource with required arguments such as name, capacity, unit, budget_type, window, applicable_on, group_by, action, status, and a scope block. The scope block specifies included/excluded users and roles.

```hcl
resource "sumologic_scan_budget" "budget" {
  name          = "TestBudget"
  capacity      = 10
  unit          = "GB"
  budget_type   = "ScanBudget"
  window        = "Query"
  applicable_on = "PerEntity"
  group_by      = "User"
  action        = "StopScan"
  status        = "active"
  scope {
      included_users = ["000000000000011C"]
      excluded_users = []
      included_roles = []
      excluded_roles = ["0000000000000196"]
  }
}
```

--------------------------------

### Create a Sumo Logic partition resource

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/partition.html.markdown

Creates a Sumo Logic partition with a routing expression, analytics tier, compliance flag, and default search inclusion. The lifecycle block prevents accidental deletion of the partition.

```hcl
resource "sumologic_partition" "examplePartition" {
  name = "terraform_examplePartition"
  routing_expression = "_sourcecategory=*/Terraform"
  analytics_tier = "continuous"
  is_compliant = false
  is_included_in_default_search = true
  lifecycle {
    prevent_destroy = true
  }
}
```

--------------------------------

### Import CloudWatch source by names

Source: https://github.com/sumologic/terraform-provider-sumologic/blob/master/website/docs/r/cloudwatch_source.html.markdown

Imports a CloudWatch source using the collector name and source name in the format `collectorName/sourceName`. Replace the example names with your actual collector and source names.

```hcl
terraform import sumologic_cloudwatch_source.test my-test-collector/my-test-source
```
Tokens:
Raw