BadArgumentError- Query could not be parsed at '|' on line [14,0]

Mohammed, Abdul Kareem 1 Reputation point
2022-11-18T20:38:21.693+00:00

Hello,
I am getting this error when I am using this query in log analytics.

This is my query. The query runs fine when I use in log analytics. But when I create the rule, I get this error.

> let _serviceName = "my-service";
let _namespace = "prod";
let containerList = KubePodInventory
| where ServiceName == tolower(_serviceName)
| summarize max(TimeGenerated) by ContainerID
| summarize ContainerID=make_list(ContainerID, 200000);
ContainerLog
| where ContainerID in (containerList)
| where LogEntry contains "processing"
| where TimeGenerated > ago(2h)
| order by TimeGenerated desc
| project TimeGenerated, LogEntry;

262052-image.png

I want to send an alert to email/teams channel when there are no logs in the past two hours.

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,661 questions
Azure Kubernetes Service
Azure Kubernetes Service
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
2,456 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Alistair Ross 7,466 Reputation points Microsoft Employee
    2022-11-19T00:39:15.223+00:00

    Hi @Mohammed, Abdul Kareem

    I all you need to do is remove the command break " ;" off the end of the query.

    Kind regards

    Alistair

    4 people found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.