Scheduled Query Rules - List By Resource Group
List the Log Search rules within a resource group.
GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Insights/scheduledQueryRules?api-version=2018-04-16
GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Insights/scheduledQueryRules?api-version=2018-04-16&$filter={$filter}
URI Parameters
Name | In | Required | Type | Description |
---|---|---|---|---|
resource
|
path | True |
string |
The name of the resource group. The name is case insensitive. |
subscription
|
path | True |
string |
The ID of the target subscription. |
api-version
|
query | True |
string |
The API version to use for this operation. |
$filter
|
query |
string |
The filter to apply on the operation. For more information please see https://msdn.microsoft.com/en-us/library/azure/dn931934.aspx |
Responses
Name | Type | Description |
---|---|---|
200 OK |
Successful request for a list of alert rules |
|
Other Status Codes |
Error response describing why the operation failed. |
Security
azure_auth
Azure Active Directory OAuth2 Flow
Type:
oauth2
Flow:
implicit
Authorization URL:
https://login.microsoftonline.com/common/oauth2/authorize
Scopes
Name | Description |
---|---|
user_impersonation | impersonate your user account |
Examples
List rules
Sample request
GET https://management.azure.com/subscriptions/14ddf0c5-77c5-4b53-84f6-e1fa43ad68f7/resourcegroups/gigtest/providers/Microsoft.Insights/scheduledQueryRules?api-version=2018-04-16
Sample response
{
"value": [
{
"id": "/subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo",
"name": "logalertfoo",
"type": "Microsoft.Insights/scheduledQueryRules",
"location": "West US",
"tags": {},
"properties": {
"description": "log alert description",
"enabled": "false",
"lastUpdatedTime": "2017-06-23T21:23:52.0221265Z",
"provisioningState": "Succeeded",
"source": {
"query": "requests",
"queryType": "ResultCount",
"dataSourceId": "/subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI"
},
"schedule": {
"frequencyInMinutes": 15,
"timeWindowInMinutes": 15
},
"action": {
"odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction",
"severity": "1",
"trigger": {
"thresholdOperator": "GreaterThan",
"threshold": 2,
"metricTrigger": {
"thresholdOperator": "LessThan",
"threshold": 2,
"metricTriggerType": "Total",
"metricColumn": "user_Id"
}
},
"aznsAction": {
"actionGroup": [],
"emailSubject": "Email Header",
"customWebhookPayload": "{}"
}
}
}
},
{
"id": "/subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo",
"name": "logalertfoo",
"type": "Microsoft.Insights/scheduledQueryRules",
"location": "West US",
"tags": {},
"properties": {
"description": "log alert description",
"enabled": "true",
"lastUpdatedTime": "2017-06-23T21:23:52.0221265Z",
"provisioningState": "Succeeded",
"source": {
"query": "requests",
"queryType": "ResultCount",
"dataSourceId": "/subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI"
},
"schedule": {
"frequencyInMinutes": 10,
"timeWindowInMinutes": 30
},
"action": {
"odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction",
"severity": "1",
"trigger": {
"thresholdOperator": "GreaterThan",
"threshold": 3
},
"aznsAction": {
"actionGroup": [],
"emailSubject": "Email Header",
"customWebhookPayload": "{}"
}
}
}
}
]
}
Definitions
Name | Description |
---|---|
Alerting |
Specify action need to be taken when rule type is Alert |
Alert |
Severity Level of Alert |
Az |
Azure action group |
Conditional |
Result Condition Evaluation criteria. |
Criteria |
Specifies the criteria for converting log to metric. |
Dimension |
Specifies the criteria for converting log to metric. |
enabled |
The flag which indicates whether the Log Search rule is enabled. Value should be true or false |
Error |
Describes the format of Error response. |
Error |
Describes the format of Error response. |
Log |
A log metrics trigger descriptor. |
Log |
The Log Search Rule resource. |
Log |
Represents a collection of Log Search rule resources. |
Log |
Specify action need to be taken when rule type is converting log to metric |
metric |
Metric Trigger Type - 'Consecutive' or 'Total' |
operator |
Operator for dimension values |
provisioning |
Provisioning state of the scheduled query rule |
Query |
Set value to 'ResultAccount' |
Schedule |
Defines how often to run the search and the time interval. |
Source |
Specifies the log search query. |
Trigger |
The condition that results in the Log Search rule. |
AlertingAction
Specify action need to be taken when rule type is Alert
Name | Type | Description |
---|---|---|
aznsAction |
Azure action group reference. |
|
odata.type |
string:
Microsoft. |
Specifies the action. Supported values - AlertingAction, LogToMetricAction |
severity |
Severity of the alert |
|
throttlingInMin |
integer |
time (in minutes) for which Alerts should be throttled or suppressed. |
trigger |
The trigger condition that results in the alert rule being. |
AlertSeverity
Severity Level of Alert
Name | Type | Description |
---|---|---|
0 |
string |
|
1 |
string |
|
2 |
string |
|
3 |
string |
|
4 |
string |
AzNsActionGroup
Azure action group
Name | Type | Description |
---|---|---|
actionGroup |
string[] |
Azure Action Group reference. |
customWebhookPayload |
string |
Custom payload to be sent for all webhook URI in Azure action group |
emailSubject |
string |
Custom subject override for all email ids in Azure action group |
ConditionalOperator
Result Condition Evaluation criteria.
Name | Type | Description |
---|---|---|
Equal |
string |
|
GreaterThan |
string |
|
GreaterThanOrEqual |
string |
|
LessThan |
string |
|
LessThanOrEqual |
string |
Criteria
Specifies the criteria for converting log to metric.
Name | Type | Description |
---|---|---|
dimensions |
List of Dimensions for creating metric |
|
metricName |
string |
Name of the metric |
Dimension
Specifies the criteria for converting log to metric.
Name | Type | Description |
---|---|---|
name |
string |
Name of the dimension |
operator |
Operator for dimension values |
|
values |
string[] |
List of dimension values |
enabled
The flag which indicates whether the Log Search rule is enabled. Value should be true or false
Name | Type | Description |
---|---|---|
false |
string |
|
true |
string |
ErrorContract
Describes the format of Error response.
Name | Type | Description |
---|---|---|
error |
The error details. |
ErrorResponse
Describes the format of Error response.
Name | Type | Description |
---|---|---|
code |
string |
Error code |
message |
string |
Error message indicating why the operation failed. |
LogMetricTrigger
A log metrics trigger descriptor.
Name | Type | Default value | Description |
---|---|---|---|
metricColumn |
string |
Evaluation of metric on a particular column |
|
metricTriggerType | Consecutive |
Metric Trigger Type - 'Consecutive' or 'Total' |
|
threshold |
number |
The threshold of the metric trigger. |
|
thresholdOperator | GreaterThanOrEqual |
Evaluation operation for Metric -'GreaterThan' or 'LessThan' or 'Equal'. |
LogSearchRuleResource
The Log Search Rule resource.
Name | Type | Default value | Description |
---|---|---|---|
etag |
string |
The etag field is not required. If it is provided in the response body, it must also be provided as a header per the normal etag convention. Entity tags are used for comparing two or more entities from the same requested resource. HTTP/1.1 uses entity tags in the etag (section 14.19), If-Match (section 14.24), If-None-Match (section 14.26), and If-Range (section 14.27) header fields. |
|
id |
string |
Azure resource Id |
|
kind |
string |
Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type. If supported, the resource provider must validate and persist this value. |
|
location |
string |
Resource location |
|
name |
string |
Azure resource name |
|
properties.action | Action: |
Action needs to be taken on rule execution. |
|
properties.autoMitigate |
boolean |
False |
The flag that indicates whether the alert should be automatically resolved or not. The default is false. |
properties.createdWithApiVersion |
string |
The api-version used when creating this alert rule |
|
properties.description |
string |
The description of the Log Search rule. |
|
properties.displayName |
string |
The display name of the alert rule |
|
properties.enabled |
The flag which indicates whether the Log Search rule is enabled. Value should be true or false |
||
properties.isLegacyLogAnalyticsRule |
boolean |
True if alert rule is legacy Log Analytic rule |
|
properties.lastUpdatedTime |
string |
Last time the rule was updated in IS08601 format. |
|
properties.provisioningState |
Provisioning state of the scheduled query rule |
||
properties.schedule |
Schedule (Frequency, Time Window) for rule. Required for action type - AlertingAction |
||
properties.source |
Data Source against which rule will Query Data |
||
tags |
object |
Resource tags |
|
type |
string |
Azure resource type |
LogSearchRuleResourceCollection
Represents a collection of Log Search rule resources.
Name | Type | Description |
---|---|---|
value |
The values for the Log Search Rule resources. |
LogToMetricAction
Specify action need to be taken when rule type is converting log to metric
Name | Type | Description |
---|---|---|
criteria |
Criteria[] |
Criteria of Metric |
odata.type |
string:
Microsoft. |
Specifies the action. Supported values - AlertingAction, LogToMetricAction |
metricTriggerType
Metric Trigger Type - 'Consecutive' or 'Total'
Name | Type | Description |
---|---|---|
Consecutive |
string |
|
Total |
string |
operator
Operator for dimension values
Name | Type | Description |
---|---|---|
Include |
string |
provisioningState
Provisioning state of the scheduled query rule
Name | Type | Description |
---|---|---|
Canceled |
string |
|
Deploying |
string |
|
Failed |
string |
|
Succeeded |
string |
QueryType
Set value to 'ResultAccount'
Name | Type | Description |
---|---|---|
ResultCount |
string |
Schedule
Defines how often to run the search and the time interval.
Name | Type | Description |
---|---|---|
frequencyInMinutes |
integer |
frequency (in minutes) at which rule condition should be evaluated. |
timeWindowInMinutes |
integer |
Time window for which data needs to be fetched for query (should be greater than or equal to frequencyInMinutes). |
Source
Specifies the log search query.
Name | Type | Description |
---|---|---|
authorizedResources |
string[] |
List of Resource referred into query |
dataSourceId |
string |
The resource uri over which log search query is to be run. |
query |
string |
Log search query. Required for action type - AlertingAction |
queryType |
Set value to 'ResultCount' . |
TriggerCondition
The condition that results in the Log Search rule.
Name | Type | Default value | Description |
---|---|---|---|
metricTrigger |
Trigger condition for metric query rule |
||
threshold |
number |
Result or count threshold based on which rule should be triggered. |
|
thresholdOperator | GreaterThanOrEqual |
Evaluation operation for rule - 'GreaterThan' or 'LessThan. |