diff --git a/main.tf b/main.tf index 9285464..ba2aacb 100644 --- a/main.tf +++ b/main.tf @@ -111,6 +111,8 @@ resource "google_pubsub_subscription" "dataflow_input_pubsub_subscription" { } resource "google_logging_project_sink" "project_log_sink" { + count = var.organization_id == null ? 1 : 0 + project = var.project name = local.project_log_sink_name destination = "pubsub.googleapis.com/projects/${var.project}/topics/${google_pubsub_topic.dataflow_input_pubsub_topic.name}" @@ -125,11 +127,19 @@ resource "google_logging_project_sink" "project_log_sink" { unique_writer_identity = true } -# resource "google_logging_organization_sink" "organization_log_sink" { -# name = local.organization_log_sink_name -# org_id = "ORGANIZATION_ID" -# destination = "pubsub.googleapis.com/projects/${var.project}/topics/${google_pubsub_topic.dataflow_input_pubsub_topic.name}" -# filter = var.log_filter -# -# include_children = "true" -# } +resource "google_logging_organization_sink" "organization_log_sink" { + count = var.organization_id != null ? 1 : 0 + + name = local.organization_log_sink_name + org_id = var.organization_id + destination = "pubsub.googleapis.com/projects/${var.project}/topics/${google_pubsub_topic.dataflow_input_pubsub_topic.name}" + filter = var.log_filter + + exclusions { + name = "exclude_dataflow" + description = "Exclude dataflow logs to not create an infinite loop" + filter = "resource.type=\"dataflow_step\" AND resource.labels.job_name = \"${local.dataflow_main_job_name}\"" + } + + include_children = "true" +} diff --git a/permissions.tf b/permissions.tf index e49a8f8..213caa3 100644 --- a/permissions.tf +++ b/permissions.tf @@ -17,7 +17,8 @@ resource "google_pubsub_topic_iam_binding" "input_sub_publisher" { topic = google_pubsub_topic.dataflow_input_pubsub_topic.name role = "roles/pubsub.publisher" members = [ - google_logging_project_sink.project_log_sink.writer_identity + try(google_logging_organization_sink.organization_log_sink[0].writer_identity, + google_logging_project_sink.project_log_sink[0].writer_identity) ] } diff --git a/variables.tf b/variables.tf index a2a2985..0a457fc 100644 --- a/variables.tf +++ b/variables.tf @@ -28,6 +28,12 @@ variable "create_network" { type = bool } +variable "organization_id" { + description = "Organization ID to deploy organization sink instead of project sink" + type = string + default = null +} + variable "network" { description = "Network to deploy into" type = string