difficulty in updating the Log Analytics Workspace (LAW) query for log search alerts

Question

I am facing difficulties in updating the Log Analytics Workspace (LAW) query for log search alerts, specifically for over 200 alert rules that are based on custom log tables. The need to automate these updates arises from changes in your log aggregation setup, which alters some of the fields within the logs.

Answer 1

Please try and see if you can use the 'az monitor scheduled-query update' command can be used to make the necessary updates to the alert rules. This approach was validated in a lab environment to ensure its effectiveness and to address any semantic/syntax errors.