az monitor scheduled-query

Note

This reference is part of the scheduled-query extension for the Azure CLI (version 2.54.0 or higher). The extension will automatically install the first time you run an az monitor scheduled-query command. Learn more about extensions.

Commands to manage scheduled queries.

Commands

Name	Description	Type	Status
az monitor scheduled-query create	Create a scheduled query.	Extension	GA
az monitor scheduled-query delete	Delete a scheduled query.	Extension	GA
az monitor scheduled-query list	List all scheduled queries.	Extension	GA
az monitor scheduled-query show	Show detail of a scheduled query.	Extension	GA
az monitor scheduled-query update	Update a scheduled query.	Extension	GA

az monitor scheduled-query create

Create a scheduled query.

az monitor scheduled-query create --condition
                                  --name
                                  --resource-group
                                  --scopes
                                  [--action-groups]
                                  [--auto-mitigate {false, true}]
                                  [--check-ws-alerts-storage --cwas {false, true}]
                                  [--condition-query]
                                  [--custom-properties]
                                  [--description]
                                  [--disabled {false, true}]
                                  [--evaluation-frequency]
                                  [--location]
                                  [--mad --mute-actions-duration]
                                  [--severity]
                                  [--skip-query-validation {false, true}]
                                  [--tags]
                                  [--target-resource-type --type]
                                  [--window-size]

Examples

Create a scheduled query for a VM.

az monitor scheduled-query create -g {rg} -n {name1} --scopes {vm_id} --condition "count 'Placeholder_1' > 360 resource id _ResourceId at least 1 violations out of 5 aggregated points" --condition-query Placeholder_1="union Event, Syslog | where TimeGenerated > ago(1h) | where EventLevelName=='Error' or SeverityLevel=='err'" --description "Test rule"

Create a scheduled query for VMs in a resource group.

az monitor scheduled-query create -g {rg} -n {name1} --scopes {rg_id} --condition "count 'Placeholder_1' > 360 resource id _ResourceId at least 1 violations out of 5 aggregated points" --condition-query Placeholder_1="union Event, Syslog | where TimeGenerated > ago(1h) | where EventLevelName=='Error' or SeverityLevel=='err'" --description "Test rule"

Required Parameters

--condition

The condition which triggers the rule.

Usage: --condition {avg,min,max,total,count} ["METRIC COLUMN" from] "QUERY_PLACEHOLDER" {=,!=,>,>=,<,<=} THRESHOLD [resource id RESOURCEID] [where DIMENSION {includes,excludes} VALUE [or VALUE ...] [and DIMENSION {includes,excludes} VALUE [or VALUE ...] ...]] [at least MinTimeToFail violations out of EvaluationPeriod aggregated points]' Query placeholders can be defined in --condition-query argument Dimensions can be queried by adding the 'where' keyword and multiple dimensions can be queried by combining them with the 'and' keyword.

--name -n

Name of the scheduled query rule.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scopes

Space-separated list of scopes the rule applies to. The resources specified in this parameter must be of the same type and exist in the same location.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--action-groups

Action Group resource Ids to invoke when the alert fires.

Usage: --action-groups ACTION_GROUP_NAME_OR_ID [NAME_OR_ID,...].

--auto-mitigate

The flag that indicates whether the alert should be automatically resolved or not. The default is true.

Property	Value
Default value:	True
Accepted values:	false, true

--check-ws-alerts-storage --cwas

The flag which indicates whether this scheduled query rule should be stored in the customer's storage.

Property	Value
Default value:	False
Accepted values:	false, true

--condition-query

Query deteils to replace the placeholders in --condition argument.

--custom-properties

The properties of an alert payload.

Usage: --custom-properties ALERT_PAYLOAD_PROPERTIES [KEY=VAL,KEY=VAL ...].

--description

Free-text description of the rule.

--disabled

Disable the scheduled query.

Property	Value
Default value:	False
Accepted values:	false, true

--evaluation-frequency

Frequency with which to evaluate the rule in "##h##m##s" format.

Property	Value
Default value:	5m

--location -l

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>.

--mad --mute-actions-duration

Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired.

--severity

Severity of the alert from 0 (critical) to 4 (verbose).

Property	Value
Default value:	2

--skip-query-validation

The flag which indicates whether the provided query should be validated or not.

Property	Value
Default value:	False
Accepted values:	false, true

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

--target-resource-type --type

The resource type of the target resource(s) in scopes. This must be provided when scopes is resource group or subscription.

--window-size

Time over which to aggregate metrics in "##h##m##s" format.

Property	Value
Default value:	5m

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az monitor scheduled-query delete

Delete a scheduled query.

az monitor scheduled-query delete [--ids]
                                  [--name]
                                  [--resource-group]
                                  [--subscription]
                                  [--yes]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name -n

Name of the scheduled query rule.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--yes -y

Do not prompt for confirmation.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az monitor scheduled-query list

List all scheduled queries.

az monitor scheduled-query list [--resource-group]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az monitor scheduled-query show

Show detail of a scheduled query.

az monitor scheduled-query show [--ids]
                                [--name]
                                [--resource-group]
                                [--subscription]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name -n

Name of the scheduled query rule.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az monitor scheduled-query update

Update a scheduled query.

az monitor scheduled-query update [--action-groups]
                                  [--add]
                                  [--auto-mitigate {false, true}]
                                  [--check-ws-alerts-storage --cwas {false, true}]
                                  [--condition]
                                  [--condition-query]
                                  [--custom-properties]
                                  [--description]
                                  [--disabled {false, true}]
                                  [--evaluation-frequency]
                                  [--force-string]
                                  [--ids]
                                  [--mad --mute-actions-duration]
                                  [--name]
                                  [--remove]
                                  [--resource-group]
                                  [--set]
                                  [--severity]
                                  [--skip-query-validation {false, true}]
                                  [--subscription]
                                  [--tags]
                                  [--target-resource-type --type]
                                  [--window-size]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--action-groups

Action Group resource Ids to invoke when the alert fires.

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

Property	Value
Parameter group:	Generic Update Arguments
Default value:	[]

--auto-mitigate

The flag that indicates whether the alert should be automatically resolved or not. The default is true.

Property	Value
Accepted values:	false, true

--check-ws-alerts-storage --cwas

The flag which indicates whether this scheduled query rule should be stored in the customer's storage.

Property	Value
Accepted values:	false, true

--condition

The condition which triggers the rule.

Usage: --condition {avg,min,max,total,count} ["METRIC COLUMN" from] "QUERY_PLACEHOLDER" {=,!=,>,>=,<,<=} THRESHOLD [resource id RESOURCEID] [where DIMENSION {includes,excludes} VALUE [or VALUE ...] [and DIMENSION {includes,excludes} VALUE [or VALUE ...] ...]] [at least MinTimeToFail violations out of EvaluationPeriod aggregated points]'

Query placeholders can be defined in --condition-query argument Dimensions can be queried by adding the 'where' keyword and multiple dimensions can be queried by combining them with the 'and' keyword.

--condition-query

Query deteils to replace the placeholders in --condition argument.

--custom-properties

The properties of an alert payload.

Usage: --custom-properties ALERT_PAYLOAD_PROPERTIES [KEY=VAL,KEY=VAL ...].

--description

Free-text description of the rule.

--disabled

Disable the scheduled query.

Property	Value
Accepted values:	false, true

--evaluation-frequency

Frequency with which to evaluate the rule in "##h##m##s" format.

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Property	Value
Parameter group:	Generic Update Arguments
Default value:	False

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--mad --mute-actions-duration

Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired.

--name -n

Name of the scheduled query rule.

Property	Value
Parameter group:	Resource Id Arguments

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

Property	Value
Parameter group:	Generic Update Arguments
Default value:	[]

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

Property	Value
Parameter group:	Generic Update Arguments
Default value:	[]

--severity

Severity of the alert from 0 (critical) to 4 (verbose).

--skip-query-validation

The flag which indicates whether the provided query should be validated or not.

Property	Value
Accepted values:	false, true

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

--target-resource-type --type

The resource type of the target resource(s) in scopes. This must be provided when scopes is resource group or subscription.

--window-size

Time over which to aggregate metrics in "##h##m##s" format.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False