Skip to content

[Bug] elasticstack_kibana_data_view forces replacement due to auto-calculated field_attrs #1287

@jalogisch

Description

@jalogisch

The elasticstack_kibana_data_view resource is unexpectedly forced into a replacement state by Terraform. This occurs after the data view has been used in Kibana, which generates field popularity statistics. The provider detects these server-side generated statistics (specifically the count attribute within field_attrs) as a change from the state file, triggering a plan to replace the entire resource.

To Reproduce
Steps to reproduce the behavior:

  1. TF configuration used:

    terraform {
      required_providers {
        elasticstack = {
          source  = "elastic/elasticstack"
          version = "~> 0.11.0"
        }
      }
    }
    
    provider "elasticstack" {
      // Elasticsearch & Kibana connection details
    }
    
    resource "elasticstack_kibana_data_view" "test_view" {
      data_view = {
        title = "my-test-logs-*"
        name  = "My Test Data View"
        id    = "my-test-data-view-id"
      }
    }
  2. TF operations to execute to get the error:

    • Run terraform apply to create the resource.
    • In the Kibana UI, navigate to Discover and interact with the "My Test Data View" to generate field usage statistics.
    • Run terraform plan.
  3. See the error in the output: The plan will show that the resource needs to be replaced.

      # elasticstack_kibana_data_view.test_view must be replaced
    -/+ resource "elasticstack_kibana_data_view" "test_view" {
          ~ data_view = {
              - field_attrs     = {
                  - "host.hostname" = { # forces replacement
                      - count = 5 -> null
                    },
                  - "event.action" = { # forces replacement
                      - count = 12 -> null
                    },
                } -> null
                id              = "my-test-data-view-id"
                name            = "My Test Data View"
                # (3 unchanged attributes hidden)
            }
          ~ id        = "default/my-test-data-view-id" -> (known after apply)
            # (2 unchanged attributes hidden)
        }

Expected behavior
After the initial creation, subsequent terraform plan operations should show no changes to the infrastructure. The provider should ignore server-side, auto-calculated attributes that are not managed within the Terraform configuration.

Debug output
(To be provided after running the reproduction steps with TF_LOG=trace enabled)

Versions (please complete the following information):
 - OS: Linux
 - Terraform Version: v1.x
 - Provider version: v0.11.0
 - Elasticsearch Version: 8.x

Additional context
The root cause appears to be that the provider does not differentiate between user-managed attributes and dynamic, server-side attributes like field popularity counters. This results in a perpetual diff, making idempotent management of the resource impossible once it is actively used.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions