Terraform配置New Relic 24小时VPN流量告警遇问题求助

问题场景 #

需要通过Terraform创建New Relic告警条件，监控过去24小时内的tunnel Data Out指标，当总流量超过50GB时触发告警。

UI查询构建器中可正常运行的NRQL：

SELECT provider.tunnelDataOut.Sum FROM PrivateNetworkSample WHERE provider = 'VpcVpnTunnel' AND vpnId = 'vpn-xxx' SINCE 1 day ago

但Terraform部署时，NRQL不允许使用SINCE，尝试用aggregation_window替代后，出现以下报错：

│ Error: Validation Error: BAD_USER_INPUT
│ 
│   with newrelic_nrql_alert_condition.vpn_outbound_data,
│   on nr_vpn.tf line 23, in resource "newrelic_nrql_alert_condition" "vpn_outbound_data":
│   23: resource "newrelic_nrql_alert_condition" "vpn_outbound_data" {
│ 
│ terms[].thresholdDuration: Term duration must be a multiple of the
│ aggregation window (86400 seconds) but was 60 seconds
╵
╷
│ Error: Validation Error: BAD_USER_INPUT
│ 
│   with newrelic_nrql_alert_condition.vpn_outbound_data,
│   on nr_vpn.tf line 23, in resource "newrelic_nrql_alert_condition" "vpn_outbound_data":
│   23: resource "newrelic_nrql_alert_condition" "vpn_outbound_data" {
│ 
│ signal.aggregationWindow: Aggregation window must be in range 30 - 21600
│ seconds but was 86400 seconds

报错原因 #

1. 聚合窗口范围限制：New Relic告警条件的aggregation_window参数取值范围为30-21600秒（即5分钟到6小时），无法设置为86400秒（1天）。
2. 阈值时长倍数要求：threshold_duration必须是aggregation_window的整数倍，原配置中60秒与86400秒不满足倍数关系。

解决办法 #

调整Terraform配置，满足New Relic的参数限制，同时实现24小时流量总和的监控需求：

resource "newrelic_nrql_alert_condition" "vpn_outbound_data" {
  policy_id                  = newrelic_alert_policy.vpn_policy.id # 替换为你的告警策略ID
  name                       = "VPN Outbound Data Exceeds 50GB in 24h"
  description                = "触发条件：过去24小时内VPN隧道出站总流量超过50GB"
  type                       = "static"
  aggregation_window         = 21600  # 6小时（允许的最大值）
  aggregation_method         = "sum"  # 聚合多个窗口的数值
  aggregation_delay          = 300    # 延迟5分钟计算，确保数据完整
  value_function             = "single_value"

  nrql {
    query = "SELECT SUM(provider.tunnelDataOut.Sum) AS total_outbound FROM PrivateNetworkSample WHERE provider = 'VpcVpnTunnel' AND vpnId = '${aws_vpn_connection.aws_azure.id}' TIMESERIES 6 hours"
  }

  critical {
    operator              = "above"
    threshold             = 53687091200 # 50GB转换为字节（50*1024^3）
    threshold_duration    = 86400  # 24小时（6小时*4，满足倍数要求）
    threshold_occurrences = "all"  # 所有周期都需满足阈值条件
  }
}

配置说明 #

• aggregation_window：设为21600秒（6小时），符合New Relic的参数范围限制。
• threshold_duration：设为86400秒（24小时），是21600秒的4倍，满足倍数要求。
• NRQL查询：使用SUM()函数计算出站流量的总和，配合TIMESERIES 6 hours与聚合窗口对齐，确保每6小时计算一次该周期内的流量总和。
• aggregation_method = "sum"：将连续4个6小时周期的流量总和累加，得到过去24小时的总流量，与阈值对比触发告警。

内容的提问来源于stack exchange，提问作者João Amaro