run a script as soon as an event is added to azure log analytics

Question

I need to run a script as soon as an event is added to azure log analytics

Answer 1

@Arunkumar Akuthota Welcome to Microsoft Q&A platform and thanks for using this forum.

For your query on running a script as soon as an event is added to Azure Log Analytics, as a out of box solution that is not available. Azure Log Analytics is basically used to store data and you have to write queries on top of the data to trigger an alert which can perform certain actions , for your case I believe Webhook can be a possible solution.

• Find the query you want to execute with Log Analytics for a specific event , a sample query
• Write your custom script with in the Azure Automation runbook and configure the webhook for the same, please refer to this documentation for additional details. Have the WebHook URL ready from this step
• Create action group with webhook configuration , which will be used in the alert.
• Create a new alert rule with in the Log Analytics workspace for the query you have from first step , configure the alert frequency and scope and map to the action group you created in above step.

Flow would be that alert checks the log analytics workspace by running the query with the frequency you have set and if the alert rule passes , the webhook gets trigged and which in turn should invoke your script. Please be aware that the alert frequency cannot be less than 5 minutes with the current product functionality.

You can also explore Azure Monitor Logs connector for Logic Apps and Power Automate , which can help you query Log Analytics and perform any action based on that result.

Hope this information helps, please feel free to revert back if you have any further queries. Thank you