[Bug] resource elasticstack_kibana_alerting_rule: api call wrong

[LarsTheiss]

Describe the bug
resource elasticstack_kibana_alerting_rule: api call wrong

To Reproduce
use the example code or any other alerting rule definition

1. Terraform v1.4.6, elasticstack 0.6.2

resource "elasticstack_elasticsearch_security_user" "user" {
  username = "ingest_user"

  # Password is cleartext here for comfort, but there's also a hashed password option
  password = "***"
  roles    = ["editor"]

  # Set the custom metadata for this user
  metadata = jsonencode({
    "env"    = "testing"
    "open"   = false
    "number" = 49
  })
}

resource "elasticstack_kibana_alerting_rule" "ccr_read_exception" {
  name        = "CCR read exception test"
  consumer    = "alerts"
  notify_when = "onActionGroupChange"
  params = jsonencode({
    "duration"= "1m"
  })
  rule_type_id = "monitoring_ccr_read_exceptions"
  interval     = "1m"
  enabled      = false

#  actions      = [{ 
#     group= "default"
#     id = "05fb5b*********c0"
#     params = jsonencode({
#      "level"= "error"
#      "message" = "{{context.clusterName}}\n{{context.remoteCluster}}\n{{context.followerIndex}}\n{{context.state}}\n{{context.internalFullMessage}}"
#      })
#    },]
}

2. TF operations to execute to get the error on apply and import

3. See the error in the output:

elasticstack_kibana_alerting_rule.ccr_read_exception: Creating...
╷
│ Error: Post "/s/default/api/alerting/rule/": unsupported protocol scheme ""
│
│   with elasticstack_kibana_alerting_rule.ccr_read_exception,
│   on main.tf line 16, in resource "elasticstack_kibana_alerting_rule" "ccr_read_exception":
│   16: resource "elasticstack_kibana_alerting_rule" "ccr_read_exception" {
│
╵
ERRO[0006] Terraform invocation failed in /Users/***/.terragrunt-cache/7xeBRXEB28bLV1FB6I_LTsuSD5o/YFrMPhseczaSaLZjrzKgKYqZLG0  prefix=[/Users/***/elastic/cluster-config/test7]
ERRO[0006] 1 error occurred:
	* [/Users/***/.terragrunt-cache/7xeBRXEB28bLV1FB6I_LTsuSD5o/YFrMPhseczaSaLZjrzKgKYqZLG0] exit status 1

Expected behavior
apply/import work well.
The api call for alerting rules have to use the kibana endpoint I guess, for example:

curl -X GET https://elastic:********@mycluster.kb.northamerica-northeast1.gcp.elastic-cloud.com:9243/s/default/api/alerting/rules/_find
{"page":1,"total":16,"per_page":10,"data":[{"id":"xxxxxxxx","consumer":"alerts","tags":[],"name":"CCR read exception test","enabled":false,"throttle":null,"schedule":{"interval":"1m"},"params":{"duration":"1m"},"rule_type_id":"m
...

Debug output
Run terraform command with TF_LOG=trace and provide extended information on TF operations.

Terraform will perform the following actions:

  # elasticstack_elasticsearch_security_user.user will be created
  + resource "elasticstack_elasticsearch_security_user" "user" {
      + enabled  = true
      + id       = (known after apply)
      + metadata = jsonencode(
            {
              + env    = "testing"
              + number = 49
              + open   = false
            }
        )
      + password = (sensitive value)
      + roles    = [
          + "editor",
        ]
      + username = "ingest_user"
    }
2023-07-06T10:49:43.406+0200 [DEBUG] command: asking for input: "\nDo you want to perform these actions?"

  # elasticstack_kibana_alerting_rule.ccr_read_exception will be created
  + resource "elasticstack_kibana_alerting_rule" "ccr_read_exception" {
      + consumer              = "alerts"
      + enabled               = false
      + id                    = (known after apply)
      + interval              = "1m"
      + last_execution_date   = (known after apply)
      + last_execution_status = (known after apply)
      + name                  = "CCR read exception test"
      + notify_when           = "onActionGroupChange"
      + params                = jsonencode(
            {
              + duration = "1m"
            }
        )
      + rule_id               = (known after apply)
      + rule_type_id          = "monitoring_ccr_read_exceptions"
      + scheduled_task_id     = (known after apply)
      + space_id              = "default"
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes
2023-07-06T10:49:48.461+0200 [INFO]  backend/local: apply calling Apply
2023-07-06T10:49:48.464+0200 [DEBUG] Building and walking apply graph for NormalMode plan

2023-07-06T10:49:48.464+0200 [TRACE] Executing graph transform *terraform.ConfigTransformer
2023-07-06T10:49:48.465+0200 [TRACE] ConfigTransformer: Starting for path:
2023-07-06T10:49:48.465+0200 [TRACE] Completed graph transform *terraform.ConfigTransformer with new graph:
  elasticstack_elasticsearch_security_user.user (expand) - *terraform.nodeExpandApplyableResource
  elasticstack_kibana_alerting_rule.ccr_read_exception (expand) - *terraform.nodeExpandApplyableResource
  ------
2023-07-06T10:49:48.465+0200 [TRACE] Executing graph transform *terraform.RootVariableTransformer
2023-07-06T10:49:48.465+0200 [TRACE] Completed graph transform *terraform.RootVariableTransformer with new graph:
  elasticstack_elasticsearch_security_user.user (expand) - *terraform.nodeExpandApplyableResource
  elasticstack_kibana_alerting_rule.ccr_read_exception (expand) - *terraform.nodeExpandApplyableResource
  var.cluster_api_key - *terraform.NodeRootVariable
  var.endpoints - *terraform.NodeRootVariable
  var.kibana-alerting-roles - *terraform.NodeRootVariable
  var.password - *terraform.NodeRootVariable
  var.username - *terraform.NodeRootVariable
  ------
2023-07-06T10:49:48.465+0200 [TRACE] Executing graph transform *terraform.ModuleVariableTransformer
2023-07-06T10:49:48.465+0200 [TRACE] Completed graph transform *terraform.ModuleVariableTransformer (no changes)
2023-07-06T10:49:48.465+0200 [TRACE] Executing graph transform *terraform.LocalTransformer
2023-07-06T10:49:48.465+0200 [TRACE] Completed graph transform *terraform.LocalTransformer (no changes)
2023-07-06T10:49:48.465+0200 [TRACE] Executing graph transform *terraform.OutputTransformer
2023-07-06T10:49:48.465+0200 [TRACE] Completed graph transform *terraform.OutputTransformer (no changes)
2023-07-06T10:49:48.465+0200 [TRACE] Executing graph transform *terraform.DiffTransformer
2023-07-06T10:49:48.465+0200 [TRACE] DiffTransformer starting
2023-07-06T10:49:48.465+0200 [TRACE] DiffTransformer: found Create change for elasticstack_elasticsearch_security_user.user
2023-07-06T10:49:48.465+0200 [TRACE] DiffTransformer: elasticstack_elasticsearch_security_user.user will be represented by elasticstack_elasticsearch_security_user.user
2023-07-06T10:49:48.465+0200 [TRACE] DiffTransformer: found Create change for elasticstack_kibana_alerting_rule.ccr_read_exception
2023-07-06T10:49:48.465+0200 [TRACE] DiffTransformer: elasticstack_kibana_alerting_rule.ccr_read_exception will be represented by elasticstack_kibana_alerting_rule.ccr_read_exception
2023-07-06T10:49:48.465+0200 [TRACE] DiffTransformer complete
2023-07-06T10:49:48.465+0200 [TRACE] Completed graph transform *terraform.DiffTransformer with new graph:
  elasticstack_elasticsearch_security_user.user - *terraform.NodeApplyableResourceInstance
    elasticstack_elasticsearch_security_user.user (expand) - *terraform.nodeExpandApplyableResource
  elasticstack_elasticsearch_security_user.user (expand) - *terraform.nodeExpandApplyableResource
  elasticstack_kibana_alerting_rule.ccr_read_exception - *terraform.NodeApplyableResourceInstance
    elasticstack_kibana_alerting_rule.ccr_read_exception (expand) - *terraform.nodeExpandApplyableResource
  elasticstack_kibana_alerting_rule.ccr_read_exception (expand) - *terraform.nodeExpandApplyableResource
  var.cluster_api_key - *terraform.NodeRootVariable
  var.endpoints - *terraform.NodeRootVariable
  var.kibana-alerting-roles - *terraform.NodeRootVariable
  var.password - *terraform.NodeRootVariable
  var.username - *terraform.NodeRootVariable
  ------
  
...

2023-07-06T10:49:48.465+0200 [TRACE] Executing graph transform *terraform.AttachStateTransformer
2023-07-06T10:49:48.465+0200 [DEBUG] Resource state not found for node "elasticstack_elasticsearch_security_user.user", instance elasticstack_elasticsearch_security_user.user
2023-07-06T10:49:48.465+0200 [DEBUG] Resource state not found for node "elasticstack_kibana_alerting_rule.ccr_read_exception", instance elasticstack_kibana_alerting_rule.ccr_read_exception
2023-07-06T10:49:48.465+0200 [TRACE] Completed graph transform *terraform.AttachStateTransformer (no changes)
2023-07-06T10:49:48.465+0200 [TRACE] Executing graph transform *terraform.OrphanOutputTransformer
2023-07-06T10:49:48.465+0200 [TRACE] Completed graph transform *terraform.OrphanOutputTransformer (no changes)
2023-07-06T10:49:48.465+0200 [TRACE] Executing graph transform *terraform.AttachResourceConfigTransformer
2023-07-06T10:49:48.465+0200 [TRACE] AttachResourceConfigTransformer: attaching to "elasticstack_kibana_alerting_rule.ccr_read_exception (expand)" (*terraform.nodeExpandApplyableResource) config from main.tf:16,1-66
2023-07-06T10:49:48.465+0200 [TRACE] AttachResourceConfigTransformer: attaching provider meta configs to elasticstack_kibana_alerting_rule.ccr_read_exception (expand)
2023-07-06T10:49:48.465+0200 [TRACE] AttachResourceConfigTransformer: attaching to "elasticstack_elasticsearch_security_user.user" (*terraform.NodeApplyableResourceInstance) config from main.tf:1,1-59
2023-07-06T10:49:48.465+0200 [TRACE] AttachResourceConfigTransformer: attaching provider meta configs to     The following problems may be the cause of any confusing errors from downstream operations:
      - .email: was null, but now cty.StringVal("")
      - .full_name: was null, but now cty.StringVal("")
2023-07-06T10:49:49.287+0200 [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState to workingState for elasticstack_elasticsearch_security_user.user
2023-07-06T10:49:49.287+0200 [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState: writing state object for elasticstack_elasticsearch_security_user.user
2023-07-06T10:49:49.287+0200 [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState to workingState for elasticstack_elasticsearch_security_user.user
2023-07-06T10:49:49.287+0200 [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState: writing state object for elasticstack_elasticsearch_security_user.user
2023-07-06T10:49:49.287+0200 [TRACE] vertex "elasticstack_elasticsearch_security_user.user": visit complete
2023-07-06T10:49:49.287+0200 [TRACE] dag/walk: upstream of "provider[\"registry.terraform.io/elastic/elasticstack\"] (close)" errored, so skipping
2023-07-06T10:49:49.287+0200 [TRACE] dag/walk: upstream of "root" errored, so skipping
2023-07-06T10:49:49.287+0200 [DEBUG] states/remote: state read serial is: 5; serial is: 5
2023-07-06T10:49:49.287+0200 [DEBUG] states/remote: state read lineage is: 33b52aa6-24eb-dd4c-d011-f550b6565409; lineage is: 33b52aa6-24eb-dd4c-d011-f550b6565409
elasticstack_elasticsearch_security_user.user: Creation complete after 0s [id=****************/ingest_user]
╷
│ Error: unsupported protocol scheme ""
│
│   with elasticstack_kibana_alerting_rule.ccr_read_exception,
│   on main.tf line 16, in resource "elasticstack_kibana_alerting_rule" "ccr_read_exception":
│   16: resource "elasticstack_kibana_alerting_rule" "ccr_read_exception" {
│
╵
2023-07-06T10:49:49.604+0200 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2023-07-06T10:49:49.607+0200 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/elastic/elasticstack/0.6.2/darwin_arm64/terraform-provider-elasticstack_v0.6.2 pid=15870
2023-07-06T10:49:49.607+0200 [DEBUG] provider: plugin exited
ERRO[0009] Terraform invocation failed in /Users/******/.terragrunt-cache/7xeBRXEB28bLV1FB6I_LTsuSD5o/YFrMPhseczaSaLZjrzKgKYqZLG0  prefix=[/Users/******/elastic/cluster-config/test7]
ERRO[0009] 1 error occurred:
	* [/Users/******/.terragrunt-cache/7xeBRXEB28bLV1FB6I_LTsuSD5o/YFrMPhseczaSaLZjrzKgKYqZLG0] exit status 1

Screenshots
If applicable, add screenshots to help explain your problem.

Versions (please complete the following information):

• OS: macos
• Terraform Version 1.4.6
• Provider version tested with: 0.6.0,0.6.2
• Elasticsearch Version tested with: 7.17.11, 8.6.1

Additional context
BTW:

• the user from the tf code was successfuly created.
• can't use the actions element in the alert rule (comented in the code)

│ Error: Unsupported argument
│
│   on main.tf line 26, in resource "elasticstack_kibana_alerting_rule" "ccr_read_exception":
│   26:   actions      = [{
│
│ An argument named "actions" is not expected here. Did you mean to define a
│ block of type "actions"?

[LarsTheiss]

Full Debug Log from apply:
terraform.log

[Kushmaro]

@LarsTheiss , the error you received indicates you've not set up your kibana endpoint in the provider connection details.
So the only bug here, to me at least, is that the error message isn't quite clear.

was there anything different you intended when reporting this?

[DavidConnack]

@Kushmaro What you described is what I encountered.
Only had elastic configured

[kevinn-1]

The problem is that the error message is not descriptive AND also the official documentation doesn't specify you have to add a Kibana block under the provider. Instead it shows an elasticsearch {} block.

Please update the documentation and specify the kibana block is needed. Example:

provider "elasticstack" {
  elasticsearch {}
  kibana { 
    endpoints = ["kibana-endpoint"]
    username  = "user"
    password  = "password"
  }
}

And also, if possible allow the kibana block to use environment variables such as the specified here. As you can see in the above example I am not specifying any endpoint, username, or password for the elasticsearch block, because it is taking those from these environment variables: ELASTICSEARCH_USERNAME, ELASTICSEARCH_PASSWORD and comma-separated list ELASTICSEARCH_ENDPOINTS.

Something similar for Kibana is desired: KIBANA_USERNAME, KIBANA_PASSWORD and comma-separated list KIBANA_ENDPOINTS