Skip to content

feat: Add Terraform support for Chronicle Parser and ParserExtension#17732

Open
govisingh-dotcom wants to merge 2 commits into
GoogleCloudPlatform:mainfrom
govisingh-dotcom:chronicle-parser-govisingh
Open

feat: Add Terraform support for Chronicle Parser and ParserExtension#17732
govisingh-dotcom wants to merge 2 commits into
GoogleCloudPlatform:mainfrom
govisingh-dotcom:chronicle-parser-govisingh

Conversation

@govisingh-dotcom
Copy link
Copy Markdown

@govisingh-dotcom govisingh-dotcom commented May 26, 2026

Description

This pull request introduces Terraform support for two new resources under the Chronicle ParserService API surface:

  1. google_chronicle_parser: Manages Chronicle custom parsers (updatable, server-assigned IDs).
  2. google_chronicle_parser_extension: Manages Chronicle parser extensions (immutable, server-assigned IDs).

These resources utilize the standard regionalized control plane endpoint https://{{location}}-chronicle.googleapis.com/v1beta/ to ensure correct GFE routing, and implement short-ID mapping using the id_from_name.tmpl custom flattener for their server-assigned UUID identifiers.

Key changes include:

  • Resource definition in mmv1/products/chronicle/Parser.yaml.
  • Resource definition in mmv1/products/chronicle/ParserExtension.yaml.
  • HCL test configuration in mmv1/templates/terraform/examples/chronicle_parser_basic.tf.tmpl and chronicle_parser_full.tf.tmpl.
  • HCL test configuration in mmv1/templates/terraform/examples/chronicle_parserextension_basic.tf.tmpl and chronicle_parserextension_full.tf.tmpl.
  • Added official REST API reference and custom parser guides inside the references metadata section for both resources.
  • Implemented ignore_read_extra for asynchronous validation properties (state, validation_report, validation_stage, state_last_changed_time, extension_validation_report) to prevent eventual-consistency timing flakiness during ImportStateVerify.

Tested

To address reviewer feedback and ensure robust validation of all optional, nested, and complex UDM blocks, we added four automated acceptance tests (two per resource).

Furthermore, to guarantee safe parallel execution in the GitHub CI presubmits and prevent Spanner locking collisions, each test has been mapped to a completely unique prebuilt log type:

  • TestAccChronicleParser_chronicleParserBasicExample (WINDOWS_DHCP)
  • TestAccChronicleParser_chronicleParserFullExample (LINUX_DHCP)
  • TestAccChronicleParserExtension_chronicleParserextensionBasicExample (CISCO_DHCP)
  • TestAccChronicleParserExtension_chronicleParserextensionFullExample (AKAMAI_DHCP)

All 4 tests successfully compiled and PASSED concurrently in parallel in the developer workstation sandbox:

=== RUN   TestAccChronicleParserExtension_chronicleParserextensionBasicExample
=== RUN   TestAccChronicleParserExtension_chronicleParserextensionFullExample
=== RUN   TestAccChronicleParser_chronicleParserBasicExample
=== RUN   TestAccChronicleParser_chronicleParserFullExample
--- PASS: TestAccChronicleParser_chronicleParserBasicExample (22.07s)
--- PASS: TestAccChronicleParser_chronicleParserFullExample (22.73s)
--- PASS: TestAccChronicleParserExtension_chronicleParserextensionFullExample (25.15s)
--- PASS: TestAccChronicleParserExtension_chronicleParserextensionBasicExample (25.25s)
PASS
ok      github.com/hashicorp/terraform-provider-google-beta/google-beta/services/chronicle      25.428s

@modular-magician modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label May 26, 2026
@github-actions github-actions Bot requested a review from rileykarson May 26, 2026 13:30
@github-actions
Copy link
Copy Markdown

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@rileykarson, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

@github-actions
Copy link
Copy Markdown

@rileykarson This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

# limitations under the License.

---
name: Parser
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you break this into two PRs, one per resource type? Review quality drops tremendously when covering two separate resources in one review.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

raised a new PR - #17774
pls checkout @rileykarson @ankitgoyal0301


---
name: Parser
description: Description
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add description

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure.

@modular-magician modular-magician added service/chronicle and removed awaiting-approval Pull requests that need reviewer's approval to run presubmit tests labels May 29, 2026
@modular-magician
Copy link
Copy Markdown
Collaborator

modular-magician commented May 29, 2026

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 81e8cb1:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository Diff Link Changes
google provider View Diff 8 files changed, 4177 insertions(+)
google-beta provider View Diff 8 files changed, 4177 insertions(+)
terraform-google-conversion View Diff 2 files changed, 935 insertions(+)

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_chronicle_parser (2 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_chronicle_parser" "primary" {
  changelogs {
    entries {
      change_message = # value needed
      create_time    = # value needed
      deleted        = # value needed
      parser_version = # value needed
    }
  }
  low_code {
    field_extractors {
      append_repeated_fields = # value needed
      extractors {
        value = # value needed
      }
      preprocess_config {
        grok_regex = # value needed
        target     = # value needed
      }
    }
  }
  version_info {
    auto_upgrade_disabled = # value needed
  }
}

Resource: google_chronicle_parser_extension (2 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_chronicle_parser_extension" "primary" {
  dynamic_parsing {
    opted_fields {
      path         = # value needed
      sample_value = # value needed
    }
  }
  field_extractors {
    append_repeated_fields = # value needed
    extractors {
      precondition_op    = # value needed
      precondition_path  = # value needed
      precondition_value = # value needed
    }
    preprocess_config {
      grok_regex = # value needed
      target     = # value needed
    }
  }
}

Multiple resources added

This PR adds multiple new resources: google_chronicle_parser, google_chronicle_parser_extension. This makes review significantly more difficult. Please split it into multiple PRs, one per resource.
An override-multiple-resources label can be added to allow merging.

Test report

Analytics

Total Tests Passed Skipped Affected
44 39 1 4
Affected Service Packages
  • chronicle

Learn how VCR tests work


Step 1: Replaying Mode

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests
  • TestAccChronicleParserExtension_chronicleParserextensionBasicExample
  • TestAccChronicleParserExtension_chronicleParserextensionFullExample
  • TestAccChronicleParser_chronicleParserBasicExample
  • TestAccChronicleParser_chronicleParserFullExample

View the replaying VCR build log


Step 2: Recording Mode

Recording Mode Replaying Rerun Test Name
✅ Log TestAccChronicleParserExtension_chronicleParserextensionBasicExample
✅ Log TestAccChronicleParserExtension_chronicleParserextensionFullExample
✅ Log TestAccChronicleParser_chronicleParserBasicExample
✅ Log TestAccChronicleParser_chronicleParserFullExample

🟢 All tests passed!

View the recording VCR build log or the debug logs folder for detailed results.

@govisingh-dotcom, @ankitgoyal0301 VCR tests complete for 81e8cb1!

references:
guides:
'Custom parsers overview': 'https://cloud.google.com/chronicle/docs/detection/custom-parsers-overview'
api: 'https://cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.logTypes.parsers'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe we are directly adding support to GA provider. Please point this to v1 documentation.

- projects/{{project}}/locations/{{location}}/instances/{{instance}}/logTypes/{{logtype}}/parsers/{{parser}}
autogen_status: UGFyc2Vy
autogen_async: false
examples:
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please add update acceptance tests also?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants