Microsoft.Insights scheduledQueryRules 2018-04-16

Bicep resource definition

The scheduledQueryRules resource type can be deployed to:

For a list of changed properties in each API version, see change log.

Remarks

For guidance on deploying monitoring solutions, see Create monitoring resources by using Bicep.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Insights/scheduledQueryRules@2018-04-16' = {
  name: 'string'
  location: 'string'
  tags: {
    tagName1: 'tagValue1'
    tagName2: 'tagValue2'
  }
  properties: {
    action: {
      'odata.type': 'string'
      // For remaining properties, see Action objects
    }
    autoMitigate: bool
    description: 'string'
    displayName: 'string'
    enabled: 'string'
    schedule: {
      frequencyInMinutes: int
      timeWindowInMinutes: int
    }
    source: {
      authorizedResources: [
        'string'
      ]
      dataSourceId: 'string'
      query: 'string'
      queryType: 'ResultCount'
    }
  }
}

Action objects

Set the odata.type property to specify the type of object.

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction, use:

  'odata.type': 'Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction'
  aznsAction: {
    actionGroup: [
      'string'
    ]
    customWebhookPayload: 'string'
    emailSubject: 'string'
  }
  severity: 'string'
  throttlingInMin: int
  trigger: {
    metricTrigger: {
      metricColumn: 'string'
      metricTriggerType: 'string'
      threshold: int
      thresholdOperator: 'string'
    }
    threshold: int
    thresholdOperator: 'string'
  }

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction, use:

  'odata.type': 'Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction'
  criteria: [
    {
      dimensions: [
        {
          name: 'string'
          operator: 'Include'
          values: [
            'string'
          ]
        }
      ]
      metricName: 'string'
    }
  ]

Property values

scheduledQueryRules

Name Description Value
name The resource name string (required)

Character limit: 1-260

Valid characters:
Can't use:
*<>%{}&:\\?/# or control characters

Can't end with space or period.
location Resource location string (required)
tags Resource tags Dictionary of tag names and values. See Tags in templates
properties The rule properties of the resource. LogSearchRule (required)

LogSearchRule

Name Description Value
action Action needs to be taken on rule execution. Action (required)
autoMitigate The flag that indicates whether the alert should be automatically resolved or not. The default is false. bool
description The description of the Log Search rule. string
displayName The display name of the alert rule string
enabled The flag which indicates whether the Log Search rule is enabled. Value should be true or false 'false'
'true'
schedule Schedule (Frequency, Time Window) for rule. Required for action type - AlertingAction Schedule
source Data Source against which rule will Query Data Source (required)

Action

Name Description Value
odata.type Set the object type Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction (required)

AlertingAction

Name Description Value
odata.type Specifies the action. Supported values - AlertingAction, LogToMetricAction 'Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction' (required)
aznsAction Azure action group reference. AzNsActionGroup
severity Severity of the alert '0'
'1'
'2'
'3'
'4' (required)
throttlingInMin time (in minutes) for which Alerts should be throttled or suppressed. int
trigger The trigger condition that results in the alert rule being. TriggerCondition (required)

AzNsActionGroup

Name Description Value
actionGroup Azure Action Group reference. string[]
customWebhookPayload Custom payload to be sent for all webhook URI in Azure action group string
emailSubject Custom subject override for all email ids in Azure action group string

TriggerCondition

Name Description Value
metricTrigger Trigger condition for metric query rule LogMetricTrigger
threshold Result or count threshold based on which rule should be triggered. int (required)
thresholdOperator Evaluation operation for rule - 'GreaterThan' or 'LessThan. 'Equal'
'GreaterThan'
'GreaterThanOrEqual'
'LessThan'
'LessThanOrEqual' (required)

LogMetricTrigger

Name Description Value
metricColumn Evaluation of metric on a particular column string
metricTriggerType Metric Trigger Type - 'Consecutive' or 'Total' 'Consecutive'
'Total'
threshold The threshold of the metric trigger. int
thresholdOperator Evaluation operation for Metric -'GreaterThan' or 'LessThan' or 'Equal'. 'Equal'
'GreaterThan'
'GreaterThanOrEqual'
'LessThan'
'LessThanOrEqual'

LogToMetricAction

Name Description Value
odata.type Specifies the action. Supported values - AlertingAction, LogToMetricAction 'Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction' (required)
criteria Criteria of Metric Criteria[] (required)

Criteria

Name Description Value
dimensions List of Dimensions for creating metric Dimension[]
metricName Name of the metric string (required)

Dimension

Name Description Value
name Name of the dimension string (required)
operator Operator for dimension values 'Include' (required)
values List of dimension values string[] (required)

Schedule

Name Description Value
frequencyInMinutes frequency (in minutes) at which rule condition should be evaluated. int (required)
timeWindowInMinutes Time window for which data needs to be fetched for query (should be greater than or equal to frequencyInMinutes). int (required)

Source

Name Description Value
authorizedResources List of Resource referred into query string[]
dataSourceId The resource uri over which log search query is to be run. string (required)
query Log search query. Required for action type - AlertingAction string
queryType Set value to 'ResultCount' . 'ResultCount'

ARM template resource definition

The scheduledQueryRules resource type can be deployed to:

For a list of changed properties in each API version, see change log.

Remarks

For guidance on deploying monitoring solutions, see Create monitoring resources by using Bicep.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following JSON to your template.

{
  "type": "Microsoft.Insights/scheduledQueryRules",
  "apiVersion": "2018-04-16",
  "name": "string",
  "location": "string",
  "tags": {
    "tagName1": "tagValue1",
    "tagName2": "tagValue2"
  },
  "properties": {
    "action": {
      "odata.type": "string"
      // For remaining properties, see Action objects
    },
    "autoMitigate": "bool",
    "description": "string",
    "displayName": "string",
    "enabled": "string",
    "schedule": {
      "frequencyInMinutes": "int",
      "timeWindowInMinutes": "int"
    },
    "source": {
      "authorizedResources": [ "string" ],
      "dataSourceId": "string",
      "query": "string",
      "queryType": "ResultCount"
    }
  }
}

Action objects

Set the odata.type property to specify the type of object.

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction, use:

  "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction",
  "aznsAction": {
    "actionGroup": [ "string" ],
    "customWebhookPayload": "string",
    "emailSubject": "string"
  },
  "severity": "string",
  "throttlingInMin": "int",
  "trigger": {
    "metricTrigger": {
      "metricColumn": "string",
      "metricTriggerType": "string",
      "threshold": "int",
      "thresholdOperator": "string"
    },
    "threshold": "int",
    "thresholdOperator": "string"
  }

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction, use:

  "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction",
  "criteria": [
    {
      "dimensions": [
        {
          "name": "string",
          "operator": "Include",
          "values": [ "string" ]
        }
      ],
      "metricName": "string"
    }
  ]

Property values

scheduledQueryRules

Name Description Value
type The resource type 'Microsoft.Insights/scheduledQueryRules'
apiVersion The resource api version '2018-04-16'
name The resource name string (required)

Character limit: 1-260

Valid characters:
Can't use:
*<>%{}&:\\?/# or control characters

Can't end with space or period.
location Resource location string (required)
tags Resource tags Dictionary of tag names and values. See Tags in templates
properties The rule properties of the resource. LogSearchRule (required)

LogSearchRule

Name Description Value
action Action needs to be taken on rule execution. Action (required)
autoMitigate The flag that indicates whether the alert should be automatically resolved or not. The default is false. bool
description The description of the Log Search rule. string
displayName The display name of the alert rule string
enabled The flag which indicates whether the Log Search rule is enabled. Value should be true or false 'false'
'true'
schedule Schedule (Frequency, Time Window) for rule. Required for action type - AlertingAction Schedule
source Data Source against which rule will Query Data Source (required)

Action

Name Description Value
odata.type Set the object type Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction (required)

AlertingAction

Name Description Value
odata.type Specifies the action. Supported values - AlertingAction, LogToMetricAction 'Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction' (required)
aznsAction Azure action group reference. AzNsActionGroup
severity Severity of the alert '0'
'1'
'2'
'3'
'4' (required)
throttlingInMin time (in minutes) for which Alerts should be throttled or suppressed. int
trigger The trigger condition that results in the alert rule being. TriggerCondition (required)

AzNsActionGroup

Name Description Value
actionGroup Azure Action Group reference. string[]
customWebhookPayload Custom payload to be sent for all webhook URI in Azure action group string
emailSubject Custom subject override for all email ids in Azure action group string

TriggerCondition

Name Description Value
metricTrigger Trigger condition for metric query rule LogMetricTrigger
threshold Result or count threshold based on which rule should be triggered. int (required)
thresholdOperator Evaluation operation for rule - 'GreaterThan' or 'LessThan. 'Equal'
'GreaterThan'
'GreaterThanOrEqual'
'LessThan'
'LessThanOrEqual' (required)

LogMetricTrigger

Name Description Value
metricColumn Evaluation of metric on a particular column string
metricTriggerType Metric Trigger Type - 'Consecutive' or 'Total' 'Consecutive'
'Total'
threshold The threshold of the metric trigger. int
thresholdOperator Evaluation operation for Metric -'GreaterThan' or 'LessThan' or 'Equal'. 'Equal'
'GreaterThan'
'GreaterThanOrEqual'
'LessThan'
'LessThanOrEqual'

LogToMetricAction

Name Description Value
odata.type Specifies the action. Supported values - AlertingAction, LogToMetricAction 'Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction' (required)
criteria Criteria of Metric Criteria[] (required)

Criteria

Name Description Value
dimensions List of Dimensions for creating metric Dimension[]
metricName Name of the metric string (required)

Dimension

Name Description Value
name Name of the dimension string (required)
operator Operator for dimension values 'Include' (required)
values List of dimension values string[] (required)

Schedule

Name Description Value
frequencyInMinutes frequency (in minutes) at which rule condition should be evaluated. int (required)
timeWindowInMinutes Time window for which data needs to be fetched for query (should be greater than or equal to frequencyInMinutes). int (required)

Source

Name Description Value
authorizedResources List of Resource referred into query string[]
dataSourceId The resource uri over which log search query is to be run. string (required)
query Log search query. Required for action type - AlertingAction string
queryType Set value to 'ResultCount' . 'ResultCount'

Terraform (AzAPI provider) resource definition

The scheduledQueryRules resource type can be deployed to:

  • Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Insights/scheduledQueryRules@2018-04-16"
  name = "string"
  location = "string"
  parent_id = "string"
  tags = {
    tagName1 = "tagValue1"
    tagName2 = "tagValue2"
  }
  body = jsonencode({
    properties = {
      action = {
        odata.type = "string"
        // For remaining properties, see Action objects
      }
      autoMitigate = bool
      description = "string"
      displayName = "string"
      enabled = "string"
      schedule = {
        frequencyInMinutes = int
        timeWindowInMinutes = int
      }
      source = {
        authorizedResources = [
          "string"
        ]
        dataSourceId = "string"
        query = "string"
        queryType = "ResultCount"
      }
    }
  })
}

Action objects

Set the odata.type property to specify the type of object.

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction, use:

  odata.type = "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction"
  aznsAction = {
    actionGroup = [
      "string"
    ]
    customWebhookPayload = "string"
    emailSubject = "string"
  }
  severity = "string"
  throttlingInMin = int
  trigger = {
    metricTrigger = {
      metricColumn = "string"
      metricTriggerType = "string"
      threshold = int
      thresholdOperator = "string"
    }
    threshold = int
    thresholdOperator = "string"
  }

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction, use:

  odata.type = "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction"
  criteria = [
    {
      dimensions = [
        {
          name = "string"
          operator = "Include"
          values = [
            "string"
          ]
        }
      ]
      metricName = "string"
    }
  ]

Property values

scheduledQueryRules

Name Description Value
type The resource type "Microsoft.Insights/scheduledQueryRules@2018-04-16"
name The resource name string (required)

Character limit: 1-260

Valid characters:
Can't use:
*<>%{}&:\\?/# or control characters

Can't end with space or period.
location Resource location string (required)
parent_id To deploy to a resource group, use the ID of that resource group. string (required)
tags Resource tags Dictionary of tag names and values.
properties The rule properties of the resource. LogSearchRule (required)

LogSearchRule

Name Description Value
action Action needs to be taken on rule execution. Action (required)
autoMitigate The flag that indicates whether the alert should be automatically resolved or not. The default is false. bool
description The description of the Log Search rule. string
displayName The display name of the alert rule string
enabled The flag which indicates whether the Log Search rule is enabled. Value should be true or false "false"
"true"
schedule Schedule (Frequency, Time Window) for rule. Required for action type - AlertingAction Schedule
source Data Source against which rule will Query Data Source (required)

Action

Name Description Value
odata.type Set the object type Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction (required)

AlertingAction

Name Description Value
odata.type Specifies the action. Supported values - AlertingAction, LogToMetricAction "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction" (required)
aznsAction Azure action group reference. AzNsActionGroup
severity Severity of the alert "0"
"1"
"2"
"3"
"4" (required)
throttlingInMin time (in minutes) for which Alerts should be throttled or suppressed. int
trigger The trigger condition that results in the alert rule being. TriggerCondition (required)

AzNsActionGroup

Name Description Value
actionGroup Azure Action Group reference. string[]
customWebhookPayload Custom payload to be sent for all webhook URI in Azure action group string
emailSubject Custom subject override for all email ids in Azure action group string

TriggerCondition

Name Description Value
metricTrigger Trigger condition for metric query rule LogMetricTrigger
threshold Result or count threshold based on which rule should be triggered. int (required)
thresholdOperator Evaluation operation for rule - 'GreaterThan' or 'LessThan. "Equal"
"GreaterThan"
"GreaterThanOrEqual"
"LessThan"
"LessThanOrEqual" (required)

LogMetricTrigger

Name Description Value
metricColumn Evaluation of metric on a particular column string
metricTriggerType Metric Trigger Type - 'Consecutive' or 'Total' "Consecutive"
"Total"
threshold The threshold of the metric trigger. int
thresholdOperator Evaluation operation for Metric -'GreaterThan' or 'LessThan' or 'Equal'. "Equal"
"GreaterThan"
"GreaterThanOrEqual"
"LessThan"
"LessThanOrEqual"

LogToMetricAction

Name Description Value
odata.type Specifies the action. Supported values - AlertingAction, LogToMetricAction "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction" (required)
criteria Criteria of Metric Criteria[] (required)

Criteria

Name Description Value
dimensions List of Dimensions for creating metric Dimension[]
metricName Name of the metric string (required)

Dimension

Name Description Value
name Name of the dimension string (required)
operator Operator for dimension values "Include" (required)
values List of dimension values string[] (required)

Schedule

Name Description Value
frequencyInMinutes frequency (in minutes) at which rule condition should be evaluated. int (required)
timeWindowInMinutes Time window for which data needs to be fetched for query (should be greater than or equal to frequencyInMinutes). int (required)

Source

Name Description Value
authorizedResources List of Resource referred into query string[]
dataSourceId The resource uri over which log search query is to be run. string (required)
query Log search query. Required for action type - AlertingAction string
queryType Set value to 'ResultCount' . "ResultCount"