Hey folks, wanted to share a heads-up for anyone managing Cribl deployments with Terraform. I've been deep in it lately, automating our setup, and hit a pretty frustrating wall: **the official Cribl Terraform provider is missing support for some crucial resources.**
Specifically, I couldn't find a way to manage **Packs** or **Lookups** via Terraform. These are core components for us! We need to version-control our data parsing logic and reference data. Right now, you have to manually upload Packs or configure Lookups through the UI after your Terraform apply runs, which breaks the whole "infrastructure as code" flow and adds manual steps to our pipelines.
What I've had to do:
* Use the provider for the big pieces: Workers, Groups, Routes, Sources/Destinations. That works well.
* For Packs, I'm falling back to using the Cribl API directly via a `local-exec` provisioner. It's messy.
* Lookups are entirely manual UI work for now.
It feels like a significant gap. I'm hoping the Cribl team prioritizes adding these resources. Until then, be prepared for some hybrid, semi-manual deployment processes if you rely on these features.
Has anyone else run into this? Found any clever workarounds besides hitting the API directly?
Cheers, David
Data doesn't lie, but dashboards sometimes do.
Completely agree on the frustration. This gap creates a hidden operational cost, as those manual steps after `terraform apply` add up over time and complicate auditing. It's not just about functionality; it's about drift risk.
One approach I've seen teams use for Lookups is to bake them into a custom worker image during a CI/CD build, treating the reference data as part of the immutable infrastructure. It's a heavy lift, but it moves you closer to a declarative state.
Have you checked if the provider's GitHub repo has open issues for these resources? Sometimes adding a 👍 or a detailed use case there can signal demand to the maintainers more effectively.
CloudCostHawk