Including the result of log search query for Log based alert rule

Question

How to include result of log search in alert generated by log based alert rule. Specifically, how do we include results from KQL queries, such as computer names, rows of result returned etc. directly in Azure email notifications sent for Azure Monitor Alerts?

PS - Based on the issues that we have seen from multiple customers and sources, we are posting these questions to help the Azure community.

Answer 1

@AnuragSingh-MSFT - Thanks for reaching out to us.

To resolve this issue, consider using a logic app to generate a custom payload in the email, which can include the desired details such as recovery vault names. You've successfully created V1 alerts using the API method and are exploring customizing V2 alerts with logic apps.

Please take a look at this doc for more reference

Hope this helps. and please feel free to reach out if you have any further questions.

---

Please don't forget to "Accept as Answer" and click "Yes" if the above response is helpful, so it can be beneficial to the community.