Log Search Alert V2 – Customizable Email Subject does not resolve dynamic columns from Single Event (Preview)

Question

Hello,

I am trying to use the Customizable Email Subjects for Log Search Alerts V2 feature as announced here: https://techcommunity.microsoft.com/blog/azureobservabilityblog/announcing-the-launch-of-customizable-email-subjects-for-log-search-alerts-v2-in/4411910

According to the documentation, it should be possible to reference columns from a Log Analytics query in the email subject when using Single event (preview).

However, I am unable to get any dynamic value from the query output to be resolved in the email subject.

---

Query Used (Single event – preview)

AddonAzureBackupJobs
| where BackupManagementType == "IaaSVM"
| where JobOperation == "Backup"
| where JobStatus in ("Completed", "Failed")
| extend Status = case(JobStatus == "Completed", "SUCCESS",
                       JobStatus == "Failed", "FAILED",
                       "UNKNOWN")
| extend Resource = split(BackupItemUniqueId, ";")[-1]
| project TimeGenerated, Resource, Status

Sample Output

TimeGenerated                Resource     Status
2/4/2026 11:20:51 PM         damsgfs03    SUCCESS

---

Expected Email Subject

[AZURE][BACKUP][CLIENT=DAM][RESOURCE=damsgfs03][RESULTAT=SUCCESS]

---

What I Tried

I attempted multiple formats documented or commonly used for alertContext parsing:

${data.alertContext.SearchQueryResults[0][1]}
${data.alertContext.SearchQueryResults[0]["Resource"]}
${data.alertContext.SearchQueryResults.tables[0].rows[0][0]}
${data.alertContext.SearchQueryResults.tables[0].rows[0]["Resource"]}
${data.alertContext.SearchQueryResults.tables[0].rows}

Example subject:

[AZURE][BACKUP][CLIENT=DAM]
SimpleIndex: [RESOURCE=${data.alertContext.SearchQueryResults[0][1]}][STATUS=${data.alertContext.SearchQueryResults[0][2]}]
SimpleKey: [RESOURCE=${data.alertContext.SearchQueryResults[0]["Resource"]}][STATUS=${data.alertContext.SearchQueryResults[0]["Status"]}]
TableIndex: [RESOURCE=${data.alertContext.SearchQueryResults.tables[0].rows[0][0]}][STATUS=${data.alertContext.SearchQueryResults.tables[0].rows[0][1]}]
TableKey: [RESOURCE=${data.alertContext.SearchQueryResults.tables[0].rows[0]["Resource"]}][STATUS=${data.alertContext.SearchQueryResults.tables[0].rows[0]["Status"]}]

---

Actual Result

All tokens are received literally in the email subject (not interpreted):

[RESOURCE=${data.alertContext.SearchQueryResults[0][1}]

etc.

No dynamic value is resolved.

---

Additional Notes

Alert type: Log Search Alert V2

Query type: Single event (preview)

Common Alert Schema enabled

Action Group: Email

No Logic App or webhook in between

Answer 1

It seems you are experiencing issues with resolving dynamic values in the email subject for Log Search Alerts V2. Based on the context provided, here are a few points to consider:

1. Common Alert Schema: Ensure that the Common Alert Schema is correctly configured, as it can affect how dynamic values are parsed and included in the email subject. You mentioned that it is enabled, which is good.
2. Dynamic Value Format: The format for extracting dynamic values from the alert payload should follow the common alert schema. For instance, you should use the correct path to the schema fields. The format for extracting a dynamic value is typically ${data.essentials.<field>}. Ensure that you are using the correct field names as per the schema.
3. Testing with Different Tokens: Since you are receiving the tokens literally, it may be worth testing with simpler tokens or checking if the alert is indeed firing with the expected data. Sometimes, the issue could be with the alert not returning the expected results.
4. Documentation Review: Review the documentation for any updates or specific examples related to the Single Event (preview) feature, as there may be nuances in how dynamic values are handled in this particular context.

If the issue persists, consider reaching out to Microsoft support or checking community forums for similar experiences, as they may provide additional insights or solutions.

---

References:

• Customize log search alert email subjects (preview)
• Common alert schema