Best Way Slack Alert

Question

Best Way Slack Alert

Hanna 220

What is the best way to display detailed error messages in Azure Data Factories?

1: Create a log workspace, configure Data Factories to send logs there, query it every 5 minutes using alerts, and trigger an action group through a webhook in a Logic App when the query returns a row. In the alert, I include dimensions for each column, such as start, end, and status. I then extract these dimensions from the JSON and transform them into a message in Slack.

2: Set up a 5-minute recurrence in a Logic App. Each time, query the logs with a condition "time generated >= ago(5m)." If it returns rows, post the information in Slack; otherwise, stop the execution.

Which approach would be more efficient and cost-effective?

Accepted answer

0 additional answers

Your answer

Answer 1

Amira Bedhiafi 33,866 Volunteer Moderator

For the 1st approach, it is more granular control over alert conditions and logic since it can integrate with other Azure services quickly through Logic Apps.

Alerts can be easily managed and configured for different conditions.

In the other hand, you may have a higher cost due to multiple services involved (log workspace, alerting, logic app execution) and I assume that it is slightly more complex to set up initially.

For the 2nd approach, I can say it is simpler to set up and manage as it's primarily centered around the Logic App and can be more cost-effective if only executed when there's an error (assuming low error rate).

But it is less flexibile compared to the 1st method, especially if you want to integrate with other services in the future.

Be careful it might not be as scalable as you want especially when you want to add more complex logic or conditions in the future.

In my opinion, the 1st method may be more efficient in terms of functionality and scalability.

With Logic Apps and Alerts combined, you have more control and flexibility over how and when you want to be notified, and it can be easily expanded upon in the future.

The 2nd method could be more cost-effective, especially if the Logic App only runs when there's an error.

However, the cost difference might not be significant unless you have a very high volume of logs or errors.

Hanna 220 Reputation points

2023-10-28T18:28:36.95+00:00

The second one I would run every 10 minutes and in the query I would check, that is, every 10 minutes the logic application will always run, in the first one I alert the logic application webhook when the query fails and send the dimensions with the values So, form a text and send it to Slack. However, I don't know if it is good practice to use dimensions in this way. What do you think?
Amira Bedhiafi 33,866 Reputation points Volunteer Moderator

2023-10-28T18:56:06.7633333+00:00

Checking for any issues every 10 mintes will help you react quickly if there are any failed activity runs but you may find yourself in redundant runs when there are no failures, consuming resources and possibly incurring unnecessary costs.
I think the approach where the Logic App is triggered based on alerts from a failed query, is more reactive since the Logic App runs only when there’s an actual issue.
Continue using dimensions. They enrich the alert data, since they form a more detailed and informative message for Slack.
Hanna 220 Reputation points

2023-10-28T19:22:04.9366667+00:00

Are the dimensions only used to filter or is it a good practice to also use them just so it can be displayed in Json and give more details
Hanna 220 Reputation points

2023-10-28T19:24:16.1233333+00:00

And if a pipeline doesn't have this dimension in Slack, it comes with <EMPTY_VALUE>, how would I get around this???
Hanna 220 Reputation points

2023-10-28T19:26:01.9533333+00:00

Sometimes errors have no ephemeral, that is, some dimensions are empty, is this a bad practice?

Do you have a better alternative?
Hanna 220 Reputation points

2023-10-28T19:26:22.1233333+00:00

If I run the LogicApp query every 10 minutes, I will check if there are Failures using TimeGenerated <= ago(10m)
Amira Bedhiafi 33,866 Reputation points Volunteer Moderator

2023-10-28T19:34:40.51+00:00

Q1:It's also a good practice to include them for context. Actually by displaying them in the alert's JSON, anyone reviewing the alert can immediately understand the specifics of the issue (especially for troubleshooting).

Q2:You can set up conditional logic in your alerting or formatting process. If a dimension is empty or not present, you can either omit that dimension from the Slack message or replace <EMPTY_VALUE> with a more descriptive placeholder, like Not Available or N/A.

Q3: Not necessarily. Not all errors or events will have values for every dimension. It's more important to ensure that when a dimension is relevant and available, it's captured and displayed. If certain dimensions are consistently empty and don't provide value, you might consider omitting them or revisiting their relevance.

Q4 : the approach you're using seems reasonable, there is no perfect approach.
Hanna 220 Reputation points

2023-10-28T19:46:11.4+00:00

I did it this way, what do you think? Will it be costly and not efficient? (I have 60 datafactories, the logic app will only be activated when the lines caught by the failled alert are greater than 0, it will be run at a frequency of 10 minutes)

It is good? Will it be expensive?
Hanna 220 Reputation points

2023-10-28T20:24:40.9866667+00:00

I'm afraid it's not a good practice, I'm using several data factories sending the diagnosis and doing this process that I sent above, thank you in advance for the answer.
Amira Bedhiafi 33,866 Reputation points Volunteer Moderator

2023-10-28T20:43:31.36+00:00

You didn't mention this detail since the beginning. If your Logic App is triggered only when there's a failure and is checked every 10 minutes, then you're essentially incurring costs based on the number of times the Logic App is triggered. Remember, Logic Apps are billed per execution and by the runtime duration of each execution.If failures are rare, then the Logic App won't run frequently, and costs will be low. But if you're frequently encountering failures across your 60 data factories, costs can add up.
Hanna 220 Reputation points

2023-10-28T20:54:26.3+00:00

Above is the way I'm doing it, I use the alert that checks every 5 minutes if the query fails, if it does, it will call Logic App and send the dimensions, that is, it will only run Logic App if it fails, but the Alert it will still consult every 5 minutes, it will still execute the action and have the dimensions, the Logic App execution will be rare but not the others.

However, if I do a Monitoring only with the Logic App, it would be every 10 minutes, I would use the Log Workspace Analytic to check the queries with Timegenerate >= ago(10m), and if a result comes, enter the True conditional and send it to the Slack, if not it cancels the instance and so on.

I can do it both ways, but I'm in doubt, in your opinion, which would have the lowest cost and which would be more efficient for my log scenario of 60 datafactories in a Log workspace that will have the check to send a message to slack just from the errors.
Hanna 220 Reputation points

2023-10-28T21:42:09.5066667+00:00

My intention is to make it as cheap and efficient as possible
Hanna 220 Reputation points

2023-10-28T22:22:16.29+00:00

My intention is to make it as cheap and efficient as possible

Share via

Best Way Slack Alert

0 additional answers

Your answer