Is it possible to raise multiple Azure Alerts from one Custom Log Search result?

Question

Hi there,

I have a several Linux vms (very dynamic environment) which sends SysLog to single Log Analytic Workspace. I would like to raise an Azure Alert whenever a warning appears in SysLog Log Analytic Workspace. How can I write a Custom Log Search to accomplish it?

The query I wrote:
Syslog
| project _ResourceId, SyslogMessage, SeverityLevel, EventTime
| where SeverityLevel == 'warn'
can be consumed by Azure Monitor however if two machines produce Warning in the same alert period - only one Alert will be raised. What I would like to achieve is to have one query that is capable of producing multiple alerts.

Is it possible with logs?

many thanks
Bartek

Answer 1

To get the answer on Azure log analytics service, I'd suggest to post this question to below dedicated forum as well:
https://social.msdn.microsoft.com/Forums/azure/en-US/newthread?category=windowsazureplatform&forum=opinsights

Answer 2

This question has been answered here: https://social.msdn.microsoft.com/Forums/en-US/d42ea8b9-5313-4f58-8d87-0ad600af2002/is-it-possible-to-raise-multiple-azure-alerts-from-one-custom-log-search-result?forum=opinsights

Please close the thread by accepting response as answer that helped you.