Rework Azure Search

modules/integration_azure-azure-search/README.md

@@ -57,7 +57,7 @@ Note the following parameters:
 
 These 3 parameters alongs with all variables defined in [common-variables.tf](common-variables.tf) are common to all
 [modules](../) in this repository. Other variables, specific to this module, are available in
-[variables.tf](variables.tf).
+[variables-gen.tf](variables-gen.tf).
 In general, the default configuration "works" but all of these Terraform
 [variables](https://www.terraform.io/language/values/variables) make it possible to
 customize the detectors behavior to better fit your needs.
@@ -105,4 +105,4 @@ Here is the list of required metrics for detectors in this module.
 * [Terraform SignalFx provider](https://registry.terraform.io/providers/splunk-terraform/signalfx/latest/docs)
 * [Terraform SignalFx detector](https://registry.terraform.io/providers/splunk-terraform/signalfx/latest/docs/resources/detector)
 * [Splunk Observability integrations](https://docs.splunk.com/Observability/gdi/get-data-in/integrations.html)
-* [Azure Monitor metrics](https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/metrics-supported#microsoftsearchsearchservices)
+* [Azure Monitor metrics](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-metrics/microsoft-search-searchservices-metrics)

modules/integration_azure-azure-search/conf/01-latency.yaml

@@ -0,0 +1,21 @@
+---
+module: "Azure Search"
+name: "latency"
+filtering: "filter('resource_type', 'Microsoft.Search/searchServices') and filter('primary_aggregation_type', 'true')"
+aggregation: ".mean(by=['azure_resource_name', 'azure_resource_group_name', 'azure_region'])"
+value_unit: "ms"
+transformation: true
+signals:
+ signal:
+ metric: "SearchLatency"
+rules:
+ critical:
+ threshold: 4
+ comparator: ">"
+ lasting_duration: '5m'
+ major:
+ threshold: 2
+ comparator: ">"
+ lasting_duration: '5m'
+ dependency: critical
+...

modules/integration_azure-azure-search/conf/02-throttled-queries.yaml

@@ -0,0 +1,21 @@
+---
+module: "Azure Search"
+name: "throttled queries rate"
+filtering: "filter('resource_type', 'Microsoft.Search/searchServices') and filter('primary_aggregation_type', 'true')"
+aggregation: ".mean(by=['azure_resource_name', 'azure_resource_group_name', 'azure_region'])"
+value_unit: "%"
+transformation: true
+signals:
+ signal:
+ metric: "ThrottledSearchQueriesPercentage"
+rules:
+ critical:
+ threshold: 50
+ comparator: ">"
+ lasting_duration: '5m'
+ major:
+ threshold: 20
+ comparator: ">"
+ lasting_duration: '5m'
+ dependency: critical
+...

modules/integration_azure-azure-search/conf/readme.yaml

@@ -1,3 +1,3 @@
 documentations:
  - name: Azure Monitor metrics
- url: 'https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/metrics-supported#microsoftsearchsearchservices'
+ url: 'https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-metrics/microsoft-search-searchservices-metrics'

modules/integration_azure-azure-search/detectors-gen.tf

@@ -0,0 +1,92 @@
+resource "signalfx_detector" "latency" {
+ name = format("%s %s", local.detector_name_prefix, "Azure Search latency")
+
+ authorized_writer_teams = var.authorized_writer_teams
+ teams = try(coalescelist(var.teams, var.authorized_writer_teams), null)
+ tags = compact(concat(local.common_tags, local.tags, var.extra_tags))
+
+ viz_options {
+ label = "signal"
+ value_suffix = "ms"
+ }
+
+ program_text = <<-EOF
+ base_filtering = filter('resource_type', 'Microsoft.Search/searchServices') and filter('primary_aggregation_type', 'true')
+ signal = data('SearchLatency', filter=base_filtering and ${module.filtering.signalflow})${var.latency_aggregation_function}${var.latency_transformation_function}.publish('signal')
+ detect(when(signal > ${var.latency_threshold_critical}, lasting=%{if var.latency_lasting_duration_critical == null}None%{else}'${var.latency_lasting_duration_critical}'%{endif}, at_least=${var.latency_at_least_percentage_critical})).publish('CRIT')
+ detect(when(signal > ${var.latency_threshold_major}, lasting=%{if var.latency_lasting_duration_major == null}None%{else}'${var.latency_lasting_duration_major}'%{endif}, at_least=${var.latency_at_least_percentage_major}) and (not when(signal > ${var.latency_threshold_critical}, lasting=%{if var.latency_lasting_duration_critical == null}None%{else}'${var.latency_lasting_duration_critical}'%{endif}, at_least=${var.latency_at_least_percentage_critical}))).publish('MAJOR')
+EOF
+
+ rule {
+ description = "is too high > ${var.latency_threshold_critical}ms"
+ severity = "Critical"
+ detect_label = "CRIT"
+ disabled = coalesce(var.latency_disabled_critical, var.latency_disabled, var.detectors_disabled)
+ notifications = try(coalescelist(lookup(var.latency_notifications, "critical", []), var.notifications.critical), null)
+ runbook_url = try(coalesce(var.latency_runbook_url, var.runbook_url), "")
+ tip = var.latency_tip
+ parameterized_subject = var.message_subject == "" ? local.rule_subject : var.message_subject
+ parameterized_body = var.message_body == "" ? local.rule_body : var.message_body
+ }
+
+ rule {
+ description = "is too high > ${var.latency_threshold_major}ms"
+ severity = "Major"
+ detect_label = "MAJOR"
+ disabled = coalesce(var.latency_disabled_major, var.latency_disabled, var.detectors_disabled)
+ notifications = try(coalescelist(lookup(var.latency_notifications, "major", []), var.notifications.major), null)
+ runbook_url = try(coalesce(var.latency_runbook_url, var.runbook_url), "")
+ tip = var.latency_tip
+ parameterized_subject = var.message_subject == "" ? local.rule_subject : var.message_subject
+ parameterized_body = var.message_body == "" ? local.rule_body : var.message_body
+ }
+
+ max_delay = var.latency_max_delay
+}
+
+resource "signalfx_detector" "throttled_queries_rate" {
+ name = format("%s %s", local.detector_name_prefix, "Azure Search throttled queries rate")
+
+ authorized_writer_teams = var.authorized_writer_teams
+ teams = try(coalescelist(var.teams, var.authorized_writer_teams), null)
+ tags = compact(concat(local.common_tags, local.tags, var.extra_tags))
+
+ viz_options {
+ label = "signal"
+ value_suffix = "%"
+ }
+
+ program_text = <<-EOF
+ base_filtering = filter('resource_type', 'Microsoft.Search/searchServices') and filter('primary_aggregation_type', 'true')
+ signal = data('ThrottledSearchQueriesPercentage', filter=base_filtering and ${module.filtering.signalflow})${var.throttled_queries_rate_aggregation_function}${var.throttled_queries_rate_transformation_function}.publish('signal')
+ detect(when(signal > ${var.throttled_queries_rate_threshold_critical}, lasting=%{if var.throttled_queries_rate_lasting_duration_critical == null}None%{else}'${var.throttled_queries_rate_lasting_duration_critical}'%{endif}, at_least=${var.throttled_queries_rate_at_least_percentage_critical})).publish('CRIT')
+ detect(when(signal > ${var.throttled_queries_rate_threshold_major}, lasting=%{if var.throttled_queries_rate_lasting_duration_major == null}None%{else}'${var.throttled_queries_rate_lasting_duration_major}'%{endif}, at_least=${var.throttled_queries_rate_at_least_percentage_major}) and (not when(signal > ${var.throttled_queries_rate_threshold_critical}, lasting=%{if var.throttled_queries_rate_lasting_duration_critical == null}None%{else}'${var.throttled_queries_rate_lasting_duration_critical}'%{endif}, at_least=${var.throttled_queries_rate_at_least_percentage_critical}))).publish('MAJOR')
+EOF
+
+ rule {
+ description = "is too high > ${var.throttled_queries_rate_threshold_critical}%"
+ severity = "Critical"
+ detect_label = "CRIT"
+ disabled = coalesce(var.throttled_queries_rate_disabled_critical, var.throttled_queries_rate_disabled, var.detectors_disabled)
+ notifications = try(coalescelist(lookup(var.throttled_queries_rate_notifications, "critical", []), var.notifications.critical), null)
+ runbook_url = try(coalesce(var.throttled_queries_rate_runbook_url, var.runbook_url), "")
+ tip = var.throttled_queries_rate_tip
+ parameterized_subject = var.message_subject == "" ? local.rule_subject : var.message_subject
+ parameterized_body = var.message_body == "" ? local.rule_body : var.message_body
+ }
+
+ rule {
+ description = "is too high > ${var.throttled_queries_rate_threshold_major}%"
+ severity = "Major"
+ detect_label = "MAJOR"
+ disabled = coalesce(var.throttled_queries_rate_disabled_major, var.throttled_queries_rate_disabled, var.detectors_disabled)
+ notifications = try(coalescelist(lookup(var.throttled_queries_rate_notifications, "major", []), var.notifications.major), null)
+ runbook_url = try(coalesce(var.throttled_queries_rate_runbook_url, var.runbook_url), "")
+ tip = var.throttled_queries_rate_tip
+ parameterized_subject = var.message_subject == "" ? local.rule_subject : var.message_subject
+ parameterized_body = var.message_body == "" ? local.rule_body : var.message_body
+ }
+
+ max_delay = var.throttled_queries_rate_max_delay
+}
+

modules/integration_azure-azure-search/moved.tf

@@ -0,0 +1,9 @@
+moved {
+ from = signalfx_detector.search_latency
+ to = signalfx_detector.latency
+}
+
+moved {
+ from = signalfx_detector.search_throttled_queries_rate
+ to = signalfx_detector.throttled_queries_rate
+}

modules/integration_azure-azure-search/outputs.tf

@@ -1,10 +1,10 @@
-output "search_latency" {
- description = "Detector resource for search_latency"
- value = signalfx_detector.search_latency
+output "latency" {
+ description = "Detector resource for latency"
+ value = signalfx_detector.latency
 }
 
-output "search_throttled_queries_rate" {
- description = "Detector resource for search_throttled_queries_rate"
- value = signalfx_detector.search_throttled_queries_rate
+output "throttled_queries_rate" {
+ description = "Detector resource for throttled_queries_rate"
+ value = signalfx_detector.throttled_queries_rate
 }