From de434b1f6fc7727aa81c3968a2b56ba2012815d4 Mon Sep 17 00:00:00 2001
From: Matthieu Bourgain <matthieu.bourgain@fr.clara.net>
Date: Mon, 13 Feb 2023 14:21:00 +0100
Subject: [PATCH 1/2] migrate event monitor

---
 caas/kubernetes/node/monitors-k8s-node.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/caas/kubernetes/node/monitors-k8s-node.tf b/caas/kubernetes/node/monitors-k8s-node.tf
index 4c7d7fe9..b9bf3efd 100644
--- a/caas/kubernetes/node/monitors-k8s-node.tf
+++ b/caas/kubernetes/node/monitors-k8s-node.tf
@@ -165,10 +165,10 @@ resource "datadog_monitor" "unregister_net_device" {
   count   = var.unregister_net_device_enabled == "true" ? 1 : 0
   name    = "${var.prefix_slug == "" ? "" : "[${var.prefix_slug}]"}[${var.environment}] Kubernetes Node Frequent unregister net device"
   message = coalesce(var.unregister_net_device_message, var.message)
-  type    = "event alert"
+  type    = "event-v2 alert"
 
   query = <<EOQ
-    events('sources:kubernetes priority:all ${module.filter-tags.event_alert} \"UnregisterNetDevice\"').rollup('count').last('${var.unregister_net_device_timeframe}') > ${var.unregister_net_device_threshold_critical}
+    events(\"sources:kubernetes priority:all ${module.filter-tags.event_alert} \\\"UnregisterNetDevice\\\"\").rollup(\"count\").last(\"${var.unregister_net_device_timeframe}\") > ${var.unregister_net_device_threshold_critical}
 EOQ
 
   new_host_delay    = var.new_host_delay

From c384249fc1780d8784ec6ef932169bc9d6dcb078 Mon Sep 17 00:00:00 2001
From: Matthieu Bourgain <matthieu.bourgain@fr.clara.net>
Date: Mon, 13 Feb 2023 15:03:01 +0100
Subject: [PATCH 2/2] fix eventv2

---
 caas/kubernetes/node/monitors-k8s-node.tf | 6 +-----
 common/filter-tags/locals.tf              | 3 +++
 common/filter-tags/outputs.tf             | 2 +-
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/caas/kubernetes/node/monitors-k8s-node.tf b/caas/kubernetes/node/monitors-k8s-node.tf
index b9bf3efd..1833792c 100644
--- a/caas/kubernetes/node/monitors-k8s-node.tf
+++ b/caas/kubernetes/node/monitors-k8s-node.tf
@@ -167,12 +167,9 @@ resource "datadog_monitor" "unregister_net_device" {
   message = coalesce(var.unregister_net_device_message, var.message)
   type    = "event-v2 alert"
 
-  query = <<EOQ
-    events(\"sources:kubernetes priority:all ${module.filter-tags.event_alert} \\\"UnregisterNetDevice\\\"\").rollup(\"count\").last(\"${var.unregister_net_device_timeframe}\") > ${var.unregister_net_device_threshold_critical}
-EOQ
+  query = "events(\"sources:kubernetes ${module.filter-tags.event_alert} \"UnregisterNetDevice\"\").rollup(\"count\").last(\"${var.unregister_net_device_timeframe}\") >= ${var.unregister_net_device_threshold_critical}"
 
   new_host_delay    = var.new_host_delay
-  new_group_delay   = var.new_group_delay
   notify_no_data    = false
   renotify_interval = 0
   notify_audit      = false
@@ -272,4 +269,3 @@ EOQ
 
   tags = concat(["env:${var.environment}", "type:caas", "provider:kubernetes", "resource:kubernetes-node", "team:claranet", "created-by:terraform"], var.volume_inodes_extra_tags)
 }
-
diff --git a/common/filter-tags/locals.tf b/common/filter-tags/locals.tf
index e8cbc1b1..b33411c1 100644
--- a/common/filter-tags/locals.tf
+++ b/common/filter-tags/locals.tf
@@ -32,6 +32,9 @@ locals {
   std_including_string = replace("${replace(local.including_string, "${var.filter_tags_separator}", "${local.filter_tags_separator}")}", "/ +/", " ")
   std_excluding_string = replace("${replace(local.excluding_string, "${var.filter_tags_separator}", "${local.filter_tags_separator}")}", "/ +/", " ")
 
+  event_including_string = replace("${replace(local.including_string, "${var.filter_tags_separator}", " ")}", "/ +/", " ")
+  event_excluding_string = replace("${replace(local.excluding_string, "${var.filter_tags_separator}", " -")}", "/ +/", " ")
+
   including_string = var.filter_tags_use_defaults == "true" ? join(local.filter_tags_separator, local.including_default_list) : join(local.filter_tags_separator, local.including_custom_list)
   excluding_string = join(local.filter_tags_separator, local.excluding_list)
 
diff --git a/common/filter-tags/outputs.tf b/common/filter-tags/outputs.tf
index 971a796c..d173d151 100644
--- a/common/filter-tags/outputs.tf
+++ b/common/filter-tags/outputs.tf
@@ -16,5 +16,5 @@ output "service_check" {
 # event_alert = tags:tag:val,tag2:val2 excluded_tags:excludedtag:value,exludedtag2:value2
 output "event_alert" {
   description = "The full filtering pattern for event alert monitor type"
-  value       = "tags:(${local.std_including_string})${local.std_excluding_string == "" ? "" : " excluded_tags:(${local.std_excluding_string})"}"
+  value       = "${local.event_including_string}${local.event_excluding_string == "" ? "" : local.event_excluding_string}"
 }