The chaossearch_objectgroup resource creates an object group, or updates an existing object group for specific setting changes. An object group cannot be completely replaced, but the index retention setting can be changed for a group.

For more information about object groups and their fields, see Creating Object Groups or the Create a new object group endpoint documentation.

Example Usage for a JSON Object Group

resource "chaossearch_object_group" "create-object-group" {
  bucket = "cloudtrail-object-group"
  source = "my-datasets"
  format {
    type = "JSON"
    array_flatten_depth = "1"
    field_selection = jsonencode([{
        "excludes":[
            "Records.requestParameters",
            "Records.responseElements",
            "tags"
         ],
         "type":"blacklist"    
    }])
    vertical_selection = jsonencode([{
        "excludes":[
            "Records.requestParameters",
            "Records.responseElements",
         ],
         "type":"blacklist"
    }])
  }
  filter {
      field = "key"
      prefix = "cloudtrail"
  }
  filter {
      field = "key"
      regex = "cloudtrail\\/AWSLogs\\/123457501321\\/CloudTrail\\/ap\\-northeast.*\\/201.*\\/.*\\/.*\\/123457501321_CloudTrail_ap\\-northeast.*\\.json\\.gz"
  }
  options {
    compression = "GZIP"
    col_types = jsonencode({
      "Records.accountId": "String",
      "Records.recipientAcountId": "String"
    })
  }
  partition_by = "cloudtrail/AWSLogs/123456789021/CloudTrail/(\\S.+)/2022/12/\\.*"
}

Example Usage for a CSV Log File Live Index Object Group

resource "chaossearch_object_group" "create-object-group1" {
  bucket = "cust-tf-objgrp"
  source = "mys3-datasets"
  live_events = "arn:aws:sqs:AWS-REGION:111111111111:MY-SQS-QUEUE-NAME"
  format {
    type             = "CSV"
    column_delimiter = ","
    row_delimiter    = "\n"
    header_row       = true
  }
  index_retention {
    overall       = -1
  }
  filter {
      field = "key"
      prefix = "ec"
    }
  filter {
    field = "key"
    regex = ".*"
  }
  filter {
    field = "storageClass"
    equals = "STANDARD"
  }
  options {
    compression = "GZIP"
  }
}

Argument Reference