You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/alerts/alerts-common-schema.md
+10-25Lines changed: 10 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -98,7 +98,7 @@ For sample alerts that use the common schema, including see
98
98
| Severity | The severity of the alert. Possible values are Sev0, Sev1, Sev2, Sev3, or Sev4. |
99
99
| signalType | Identifies the signal on which the alert rule was defined. Possible values are Metric, Log, or Activity Log. |
100
100
| monitorCondition | When an alert fires, the alert's monitor condition is set to **Fired**. When the underlying condition that caused the alert to fire clears, the monitor condition is set to **Resolved**. |
101
-
| monitoringService | The monitoring service or solution that generated the alert. The fields for the alert context are dictated by the monitoring service. |
101
+
| monitoringService | The monitoring service or solution that generated the alert. The monitoring service determines which fields are in the alert context. |
102
102
| alertTargetIds | The list of the Azure Resource Manager IDs that are affected targets of an alert. For a log alert defined on a Log Analytics workspace or Application Insights instance, it's the respective workspace or application. |
103
103
| configurationItems |The list of affected resources of an alert.<br>In some cases, the configuration items can be different from the alert targets. For example, in metric-for-log or log alerts defined on a Log Analytics workspace, the configuration items are the actual resources sending the telemetry and not the workspace.<br><ul><li>In the log alerts API (Scheduled Query Rules) v2021-08-01, the `configurationItem` values are taken from explicitly defined dimensions in this priority: `Computer`, `_ResourceId`, `ResourceId`, `Resource`.</li><li>In earlier versions of the log alerts API, the `configurationItem` values are taken implicitly from the results in this priority: `Computer`, `_ResourceId`, `ResourceId`, `Resource`.</li></ul>In ITSM systems, the `configurationItems` field is used to correlate alerts to resources in a configuration management database. |
104
104
| originAlertId | The ID of the alert instance, as generated by the monitoring service generating it. |
@@ -119,10 +119,10 @@ For sample alerts that use the common schema, including see
119
119
|windowSize |The time period analyzed by the alert rule.|
120
120
|allOf |Indicates that all conditions defined in the alert rule must be met to trigger an alert.|
121
121
|alertSensitivity |In an alert rule with a dynamic threshold, indicates how sensitive the rule is, or how much the value can deviate from the upper or lower threshold.|
122
-
|failingPeriods |In an alert rule with a dynamic threshold, the number of evaluation periods that do not meet the alert threshold that trigger an alert. For example, you can indicate that an alert is triggered when 3 out of the last 5 evaluation periods are not within the alert thresholds. |
122
+
|failingPeriods |In an alert rule with a dynamic threshold, the number of evaluation periods that don't meet the alert threshold that will trigger an alert. For example, you can indicate that an alert is triggered when 3 out of the last five evaluation periods aren't within the alert thresholds. |
123
123
|numberOfEvaluationPeriods|The total number of evaluations. |
124
124
|minFailingPeriodsToAlert|The minimum number of evaluations that do no meet the alert rule conditions.|
125
-
|ignoreDataBefore |(Optional.) In an alert rule with a dynamic threshold, the date from which the threshold is calculated. Use this value to indicate that the rule should not calculate the dynamic threshold using data from before the specified date. |
125
+
|ignoreDataBefore |(Optional.) In an alert rule with a dynamic threshold, the date from which the threshold is calculated. Use this value to indicate that the rule shouldn't calculate the dynamic threshold using data from before the specified date. |
126
126
|metricName |The name of the metric monitored by the alert rule. |
127
127
|metricNamespace |The namespace of the metric monitored by the alert rule. |
128
128
|operator |The logical operator of the alert rule. |
@@ -240,19 +240,19 @@ For sample alerts that use the common schema, including see
240
240
|SearchQuery |The query defined in the alert rule. |
241
241
|SearchIntervalStartTimeUtc |The start time of the evaluation window in which the alert fired in UTC. |
242
242
|SearchIntervalEndTimeUtc |The end time of the evaluation window in which the alert fired in UTC. |
243
-
|ResultCount |The number of records returned by the query. For metric measurement rules, this is the number or records that match the specific dimension combination. |
243
+
|ResultCount |The number of records returned by the query. For metric measurement rules, the number or records that match the specific dimension combination. |
244
244
|LinkToSearchResults |A link to the search results. |
245
-
|LinkToFilteredSearchResultsUI |For metric measurement rules, the link to the search results after they are filtered by the dimension combinations for which the alert is fired. |
245
+
|LinkToFilteredSearchResultsUI |For metric measurement rules, the link to the search results after they've been filtered by the dimension combinations. |
246
246
|LinkToSearchResultsAPI |A link to the query results using the Log Analytics API. |
247
-
|LinkToFilteredSearchResultsAPI |For metric measurement rules, the link to the search results using the Log Analytics API after they are filtered by the dimension combinations for which the alert is fired. |
247
+
|LinkToFilteredSearchResultsAPI |For metric measurement rules, the link to the search results using the Log Analytics API after they've been filtered by the dimension combinations. |
248
248
|SearchIntervalDurationMin |The total number of minutes in the search interval. |
249
249
|SearchIntervalInMin |The total number of minutes in the search interval. |
250
250
|Threshold |The threshold defined in the alert rule. |
251
251
|Operator |The operator defined in the alert rule. |
252
-
|ApplicationID |The Application Insigths ID on which the alert was triggered. |
252
+
|ApplicationID |The Application Insights ID on which the alert was triggered. |
253
253
|Dimensions |For metric measurement rules, the metric dimensions on which the alert was triggered. |
254
254
|name |The dimension name. |
255
-
|value |The dimesnion value. |
255
+
|value |The dimension value. |
256
256
|SearchResults |The complete search results. |
257
257
|table |The table of results in the search results. |
258
258
|name |The name of the table in the search results. |
@@ -261,7 +261,7 @@ For sample alerts that use the common schema, including see
261
261
|type |The type of the column. |
262
262
|rows |The rows in the table. |
263
263
|DataSources |The data sources on which the alert was triggered. |
264
-
|resourceID |The resource Id affected by the alert. |
264
+
|resourceID |The resource ID affected by the alert. |
265
265
|tables |The draft response tables included in the query. |
266
266
|IncludedSearchResults | Flag that indicates if the payload should contain the results. |
267
267
|AlertType |The alert type:<br> - Metric Measurement<br> - Number Of Results |
@@ -412,7 +412,6 @@ For sample alerts that use the common schema, including see
412
412
}
413
413
}
414
414
```
415
-
416
415
### Sample log alert when the monitoringService = Log Alerts V2
417
416
418
417
> [!NOTE]
@@ -459,7 +458,6 @@ For sample alerts that use the common schema, including see
459
458
}
460
459
}
461
460
```
462
-
463
461
## Alert context fields for activity log alerts
464
462
465
463
See [Azure activity log event schema](../essentials/activity-log-schema.md) for detailed information about the fields in activity log alerts.
@@ -649,20 +647,7 @@ See [Azure activity log event schema](../essentials/activity-log-schema.md) for
649
647
```
650
648
## Alert context fields for Prometheus alerts
651
649
652
-
Field |Description |
653
-
|---------|---------|
654
-
|interval ||
655
-
|expression ||
656
-
|expressionValue ||
657
-
|for ||
658
-
|labels ||
659
-
|level ||
660
-
|Environment ||
661
-
|cluster ||
662
-
|annotation ||
663
-
|summary ||
664
-
|ruleGroup ||
665
-
650
+
See [Azure Monitor managed service for Prometheus rule groups (preview)](../essentials/prometheus-rule-groups.md) for detailed information about the fields in Prometheus alerts.
0 commit comments