Azure Monitor alert email with query result

Question

Hello,

I am configuring Azure Monitor alert from application insight using a custom query and I want my query result in email for which the alert is triggered. How to achieve it ?

Answer 1

@Karthick G @Mollin Hedman Widegren @Justin Tingley Log alerts best practice is to not rely on the search results in the email. If you want context for an alert, meaning, the impacted resource / object / instance, instruct them to use dimensions. Dimensions provide the column value that fired the alert, for example: VM name from Computer column, Disk name from Instance Name column, AKS cluster name from Cluster Name column etc.

To rely on search results for alert context, but this is prone to error as we only displayed the top 10 results in the email body. For log alerts that have a custom email subject and/or JSON payload defined, enabling the common schema reverts email subject and/or payload schema to the one described as follows. This means that if you want to have a custom JSON payload defined, the webhook cannot use the common alert schema. Alerts with the common schema enabled have an upper size limit of 256 KB per alert. Search results aren't embedded in the log alerts payload if they cause the alert size to cross this threshold. You can determine this by checking the flag IncludedSearchResults. When the search results aren't included, you should use the LinkToFilteredSearchResultsAPI or LinkToSearchResultsAPI to access query results with the Log Analytics API.

As you are insisting on having raw search result within the alert, you can use logic app to do any needed customization. For more information, refer this link.