Customize alert notifications using Logic Apps

Article
12/15/2022
4 minutes to read

This article shows you how to create a Logic App and integrate it with an Azure Monitor Alert.

Azure Logic Apps allows you to build and customize workflows for integration. Use Logic Apps to customize your alert notifications.

Customize the alerts email, using your own email subject and body format.
Customize the alert metadata by looking up tags for affected resources or fetching a log query search result. For information on how to access the search result rows containing alerts data, see:
- Azure Monitor Log Analytics API response format
- Query/management HTTP response
Integrate with external services using existing connectors like Outlook, Microsoft Teams, Slack and PagerDuty, or by configuring the Logic App for your own services.

In this example, we'll use the following steps to create a Logic App that uses the common alerts schema to send details from the alert. The example uses the following steps:

Create a Logic App for sending an email or a Teams post.
Create an alert action group that triggers the logic app.
Create a rule the uses the action group.

Create a Logic App

Create a new Logic app. Set Logic App name , select Consumption Plan type.
Select Review + create, then select Create.
Select Go to resource when the deployment is complete.
On the Logic Apps Designer page, select When a HTTP request is received.

Paste the common alert schema into the Request Body JSON Schema field from the following JSON:

 {
    "type": "object",
    "properties": {
        "schemaId": {
            "type": "string"
        },
        "data": {
            "type": "object",
            "properties": {
                "essentials": {
                    "type": "object",
                    "properties": {
                        "alertId": {
                            "type": "string"
                        },
                        "alertRule": {
                            "type": "string"
                        },
                        "severity": {
                            "type": "string"
                        },
                        "signalType": {
                            "type": "string"
                        },
                        "monitorCondition": {
                            "type": "string"
                        },
                        "monitoringService": {
                            "type": "string"
                        },
                        "alertTargetIDs": {
                            "type": "array",
                            "items": {
                                "type": "string"
                            }
                        },
                        "originAlertId": {
                            "type": "string"
                        },
                        "firedDateTime": {
                            "type": "string"
                        },
                        "resolvedDateTime": {
                            "type": "string"
                        },
                        "description": {
                            "type": "string"
                        },
                        "essentialsVersion": {
                            "type": "string"
                        },
                        "alertContextVersion": {
                            "type": "string"
                        }
                    }
                },
                "alertContext": {
                    "type": "object",
                    "properties": {}
                }
            }
        }
    }
}

Select the + icon to insert a new step.
Send an email or post a Teams message.

Send an email
Post a Teams message

In the search field, search for outlook.
Select Office 365 Outlook.
Select Send an email (V2) from the list of actions.
Sign into Office 365 when prompted to create a connection.
Create the email Body by entering static text and including content taken from the alert payload by choosing fields from the Dynamic content list.
For example:
- Enter An alert has monitoring condition: then select monitorCondition from the Dynamic content list.
- Then enter Date fired: and select firedDateTime from the Dynamic content list.
- Enter Affected resources: and select alterTargetIDs from the Dynamic content list.
In the Subject field, create the subject text by entering static text and including content taken from the alert payload by choosing fields from the Dynamic content list.
For example:
- Enter Alert: and select alertRule from the Dynamic content list.
- Then enter with severity: and select severity from the Dynamic content list.
- Enter has condition: and select monitorCondition from the Dynamic content list.
Enter the email address to send the alert to in the To field.
Select Save.

You've created a Logic App that will send an email to the specified address, with details from the alert that triggered it.

The next step is to create an action group to trigger your Logic App.

Create an action group

To trigger your Logic app, create an action group, then create an alert that uses that action group.

Go to the Azure Monitor page and select Alerts from the sidebar.
Select Action groups, then select Create.
Select a Subscription, Resource group and Region.
Enter an Actions group name and Display name.
Select the Actions tab.
In the Actions tab under Action type, select Logic App.
In the Logic App section, select your logic app from the dropdown.
Set Enable common alert schema to Yes. If you select No, the alert type will determine which alert schema is used. For more information about alert schemas, see Context specific alert schemas.
Select OK.
Enter a name in the Name field.
Select Review + create, the Create.