az monitor scheduled-query

  • Reference

Note

This reference is part of the scheduled-query extension for the Azure CLI (version 2.54.0 or higher). The extension will automatically install the first time you run an az monitor scheduled-query command. Learn more about extensions.

Commands to manage scheduled queries.

Commands

Name Description Type Status
az monitor scheduled-query create

Create a scheduled query.

 Extension GA
az monitor scheduled-query delete

Delete a scheduled query.

 Extension GA
az monitor scheduled-query list

List all scheduled queries.

 Extension GA
az monitor scheduled-query show

Show detail of a scheduled query.

 Extension GA
az monitor scheduled-query update

Update a scheduled query.

 Extension GA

az monitor scheduled-query create

Create a scheduled query.

az monitor scheduled-query create --condition
                                  --name
                                  --resource-group
                                  --scopes
                                  [--action-groups]
                                  [--auto-mitigate {false, true}]
                                  [--check-ws-alerts-storage {false, true}]
                                  [--condition-query]
                                  [--custom-properties]
                                  [--description]
                                  [--disabled {false, true}]
                                  [--evaluation-frequency]
                                  [--location]
                                  [--mad]
                                  [--severity]
                                  [--skip-query-validation {false, true}]
                                  [--tags]
                                  [--target-resource-type]
                                  [--window-size]

Examples

Create a scheduled query for a VM.

az monitor scheduled-query create -g {rg} -n {name1} --scopes {vm_id} --condition "count 'Placeholder_1' > 360 resource id _ResourceId at least 1 violations out of 5 aggregated points" --condition-query Placeholder_1="union Event, Syslog | where TimeGenerated > ago(1h) | where EventLevelName=='Error' or SeverityLevel=='err'" --description "Test rule"

Create a scheduled query for VMs in a resource group.

az monitor scheduled-query create -g {rg} -n {name1} --scopes {rg_id} --condition "count 'Placeholder_1' > 360 resource id _ResourceId at least 1 violations out of 5 aggregated points" --condition-query Placeholder_1="union Event, Syslog | where TimeGenerated > ago(1h) | where EventLevelName=='Error' or SeverityLevel=='err'" --description "Test rule"

Required Parameters

--condition

The condition which triggers the rule.

Usage: --condition {avg,min,max,total,count} ["METRIC COLUMN" from] "QUERY_PLACEHOLDER" {=,!=,>,>=,<,<=} THRESHOLD [resource id RESOURCEID] [where DIMENSION {includes,excludes} VALUE [or VALUE ...] [and DIMENSION {includes,excludes} VALUE [or VALUE ...] ...]] [at least MinTimeToFail violations out of EvaluationPeriod aggregated points]' Query placeholders can be defined in --condition-query argument Dimensions can be queried by adding the 'where' keyword and multiple dimensions can be queried by combining them with the 'and' keyword.

--name -n

Name of the scheduled query rule.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scopes

Space-separated list of scopes the rule applies to. The resources specified in this parameter must be of the same type and exist in the same location.

Optional Parameters

--action-groups

Action Group resource Ids to invoke when the alert fires.

Usage: --action-groups ACTION_GROUP_NAME_OR_ID [NAME_OR_ID,...].

--auto-mitigate

The flag that indicates whether the alert should be automatically resolved or not. The default is true.

accepted values: false, true
default value: True
--check-ws-alerts-storage --cwas

The flag which indicates whether this scheduled query rule should be stored in the customer's storage.

accepted values: false, true
default value: False
--condition-query

Query deteils to replace the placeholders in --condition argument.

--custom-properties

The properties of an alert payload.

Usage: --custom-properties ALERT_PAYLOAD_PROPERTIES [KEY=VAL,KEY=VAL ...].

--description

Free-text description of the rule.

--disabled

Disable the scheduled query.

accepted values: false, true
default value: False
--evaluation-frequency

Frequency with which to evaluate the rule in "##h##m##s" format.

default value: 5m
--location -l

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>.

--mad --mute-actions-duration

Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired.

--severity

Severity of the alert from 0 (critical) to 4 (verbose).

default value: 2
--skip-query-validation

The flag which indicates whether the provided query should be validated or not.

accepted values: false, true
default value: False
--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

--target-resource-type --type

The resource type of the target resource(s) in scopes. This must be provided when scopes is resource group or subscription.

--window-size

Time over which to aggregate metrics in "##h##m##s" format.

default value: 5m
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

accepted values: json, jsonc, none, table, tsv, yaml, yamlc
default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az monitor scheduled-query delete

Delete a scheduled query.

az monitor scheduled-query delete [--ids]
                                  [--name]
                                  [--resource-group]
                                  [--subscription]
                                  [--yes]

Optional Parameters

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--name -n

Name of the scheduled query rule.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--yes -y

Do not prompt for confirmation.

default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

accepted values: json, jsonc, none, table, tsv, yaml, yamlc
default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az monitor scheduled-query list

List all scheduled queries.

az monitor scheduled-query list [--resource-group]

Optional Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

accepted values: json, jsonc, none, table, tsv, yaml, yamlc
default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az monitor scheduled-query show

Show detail of a scheduled query.

az monitor scheduled-query show [--ids]
                                [--name]
                                [--resource-group]
                                [--subscription]

Optional Parameters

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--name -n

Name of the scheduled query rule.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

accepted values: json, jsonc, none, table, tsv, yaml, yamlc
default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az monitor scheduled-query update

Update a scheduled query.

az monitor scheduled-query update [--action-groups]
                                  [--add]
                                  [--auto-mitigate {false, true}]
                                  [--check-ws-alerts-storage {false, true}]
                                  [--condition]
                                  [--condition-query]
                                  [--custom-properties]
                                  [--description]
                                  [--disabled {false, true}]
                                  [--evaluation-frequency]
                                  [--force-string]
                                  [--ids]
                                  [--mad]
                                  [--name]
                                  [--remove]
                                  [--resource-group]
                                  [--set]
                                  [--severity]
                                  [--skip-query-validation {false, true}]
                                  [--subscription]
                                  [--tags]
                                  [--target-resource-type]
                                  [--window-size]

Optional Parameters

--action-groups

Action Group resource Ids to invoke when the alert fires.

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

default value: []
--auto-mitigate

The flag that indicates whether the alert should be automatically resolved or not. The default is true.

accepted values: false, true
--check-ws-alerts-storage --cwas

The flag which indicates whether this scheduled query rule should be stored in the customer's storage.

accepted values: false, true
--condition

The condition which triggers the rule.

Usage: --condition {avg,min,max,total,count} ["METRIC COLUMN" from] "QUERY_PLACEHOLDER" {=,!=,>,>=,<,<=} THRESHOLD [resource id RESOURCEID] [where DIMENSION {includes,excludes} VALUE [or VALUE ...] [and DIMENSION {includes,excludes} VALUE [or VALUE ...] ...]] [at least MinTimeToFail violations out of EvaluationPeriod aggregated points]'

Query placeholders can be defined in --condition-query argument Dimensions can be queried by adding the 'where' keyword and multiple dimensions can be queried by combining them with the 'and' keyword.

--condition-query

Query deteils to replace the placeholders in --condition argument.

--custom-properties

The properties of an alert payload.

Usage: --custom-properties ALERT_PAYLOAD_PROPERTIES [KEY=VAL,KEY=VAL ...].

--description

Free-text description of the rule.

--disabled

Disable the scheduled query.

accepted values: false, true
--evaluation-frequency

Frequency with which to evaluate the rule in "##h##m##s" format.

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

default value: False
--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--mad --mute-actions-duration

Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired.

--name -n

Name of the scheduled query rule.

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

default value: []
--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

default value: []
--severity

Severity of the alert from 0 (critical) to 4 (verbose).

--skip-query-validation

The flag which indicates whether the provided query should be validated or not.

accepted values: false, true
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

--target-resource-type --type

The resource type of the target resource(s) in scopes. This must be provided when scopes is resource group or subscription.

--window-size

Time over which to aggregate metrics in "##h##m##s" format.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

accepted values: json, jsonc, none, table, tsv, yaml, yamlc
default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.