AZ CLI for creating scheduled query not working

Question

Hi Team,

I am trying to create a log search alert from Github actions by passing the below query:

az monitor scheduled-query create -g ${{ steps.getKeyVault.outputs.azure-resource-group }} -n Excpetion-Log-Alert --scopes ${appResourceId} --condition "count 'Placholder_1' > 0" --condition-query "AppServiceConsoleLogs \n| where tolower(ResultDescription) contains \"exception\" and TimeGenerated > ago(30m)" --action-groups ${action} --severity 3 --description "Exception rule"

But I am seeing the below exception getting raised:

ERROR: The command failed with an unexpected error. Here is the traceback:
ERROR: not enough values to unpack (expected 2, got 1)
Traceback (most recent call last):
File "/usr/local/lib/python3.10/site-packages/knack/cli.py", line 231, in invoke
cmd_result = self.invocation.execute(args)
File "/usr/local/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 588, in execute
parsed_args = self.parser.parse_args(args)
File "/usr/local/lib/python3.10/site-packages/knack/parser.py", line 261, in parse_args
return super().parse_args(args)
File "/usr/local/lib/python3.10/argparse.py", line 1826, in parse_args
args, argv = self.parse_known_args(args, namespace)
File "/usr/local/lib/python3.10/site-packages/azure/cli/core/parser.py", line 284, in parse_known_args
self._namespace, self._raw_arguments = super().parse_known_args(args=args, namespace=namespace)
File "/usr/local/lib/python3.10/argparse.py", line 1859, in parse_known_args
namespace, args = self._parse_known_args(args, namespace)
File "/usr/local/lib/python3.10/argparse.py", line 2050, in _parse_known_args
positionals_end_index = consume_positionals(start_index)
File "/usr/local/lib/python3.10/argparse.py", line 2027, in consume_positionals
take_action(action, args)
File "/usr/local/lib/python3.10/argparse.py", line 1936, in take_action
action(self, namespace, argument_values, option_string)
File "/usr/local/lib/python3.10/argparse.py", line 1214, in call
subnamespace, arg_strings = parser.parse_known_args(arg_strings, None)
File "/usr/local/lib/python3.10/site-packages/azure/cli/core/parser.py", line 284, in parse_known_args
self._namespace, self._raw_arguments = super().parse_known_args(args=args, namespace=namespace)
File "/usr/local/lib/python3.10/argparse.py", line 1859, in parse_known_args
namespace, args = self._parse_known_args(args, namespace)
File "/usr/local/lib/python3.10/argparse.py", line 2050, in _parse_known_args
positionals_end_index = consume_positionals(start_index)
File "/usr/local/lib/python3.10/argparse.py", line 2027, in consume_positionals
take_action(action, args)
File "/usr/local/lib/python3.10/argparse.py", line 1936, in take_action
action(self, namespace, argument_values, option_string)
File "/usr/local/lib/python3.10/argparse.py", line 1214, in call
subnamespace, arg_strings = parser.parse_known_args(arg_strings, None)
File "/usr/local/lib/python3.10/site-packages/azure/cli/core/parser.py", line 284, in parse_known_args
self._namespace, self._raw_arguments = super().parse_known_args(args=args, namespace=namespace)
File "/usr/local/lib/python3.10/argparse.py", line 1859, in parse_known_args
namespace, args = self._parse_known_args(args, namespace)
File "/usr/local/lib/python3.10/argparse.py", line 2050, in _parse_known_args
positionals_end_index = consume_positionals(start_index)
File "/usr/local/lib/python3.10/argparse.py", line 2027, in consume_positionals
take_action(action, args)
File "/usr/local/lib/python3.10/argparse.py", line 1936, in take_action
action(self, namespace, argument_values, option_string)
File "/usr/local/lib/python3.10/argparse.py", line 1214, in call
subnamespace, arg_strings = parser.parse_known_args(arg_strings, None)
File "/usr/local/lib/python3.10/site-packages/azure/cli/core/parser.py", line 284, in parse_known_args
self._namespace, self._raw_arguments = super().parse_known_args(args=args, namespace=namespace)
File "/usr/local/lib/python3.10/argparse.py", line 1859, in parse_known_args
namespace, args = self._parse_known_args(args, namespace)
File "/usr/local/lib/python3.10/argparse.py", line 2068, in _parse_known_args
start_index = consume_optional(start_index)
File "/usr/local/lib/python3.10/argparse.py", line 2008, in consume_optional
take_action(action, args, option_string)
File "/usr/local/lib/python3.10/argparse.py", line 1936, in take_action
action(self, namespace, argument_values, option_string)
File "/opt/az/azcliextensions/scheduled-query/azext_scheduled_query/_actions.py", line 54, in call
k, v = x.split('=', 1)
ValueError: not enough values to unpack (expected 2, got 1)
To open an issue, please run: 'az feedback'
Error: Error: az cli script failed.
cleaning up container...
MICROSOFT_AZURE_CLI_1663330610633_CONTAINER

Can you please suggest

Answer 1

Hi @Anonymous ,
Thanks for the response

The following cli is working :

az monitor scheduled-query create -g ${{ steps.getKeyVault.outputs.azure-resource-group }} -n Excpetion-Log-Alert --scopes ${appResourceId} --condition "count 'Placeholder_1' > 0" --condition-query Placeholder_1="AppServiceConsoleLogs | where tolower(ResultDescription) contains '"exception"' and TimeGenerated > ago(30m)" --action-groups ${action} --severity 3 --description "Test rule"