You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
:::image type="content" source="./media/application-proxy-configure-complex-application/add-application-segment-1.png" alt-text="Screenshot of Manage and configure application segment blade.":::
73
73
74
74
4. In the Internal Url field, enter the internal URL for your app.
75
75
76
76
5. In the External Url field, drop down the list and select the custom domain you want to use.
77
77
78
-
6. Add CORS Rules (optional). For more information see [Configuring CORS Rule](https://learn.microsoft.com/graph/api/resources/corsconfiguration_v2?view=graph-rest-beta)
78
+
6. Add CORS Rules (optional). For more information see [Configuring CORS Rule](/graph/api/resources/corsconfiguration_v2?view=graph-rest-beta).
Copy file name to clipboardExpand all lines: articles/azure-monitor/alerts/action-groups.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -125,7 +125,7 @@ When you create or update an action group in the Azure portal, you can test the
125
125
126
126
1. On the page that lists the information you entered, select **Test action group**.
127
127
128
-
:::image type="content" source="./media/action-groups/test-action-group.png" alt-text="Screenshot that shows the test action group start page with the Test option.":::
128
+
:::image type="content" source="./media/action-groups/test-action-group.png" alt-text="Screenshot that shows the test action group page with the Test option.":::
129
129
130
130
1. Select a sample type and the notification and action types that you want to test. Then select **Test**.
131
131
@@ -161,7 +161,7 @@ The following table describes the role membership requirements that are needed f
161
161
>
162
162
> When you configure an action group in the portal, you can opt in or out of the common alert schema:
163
163
>
164
-
> - To find common schema samples for all sample types, see [Common alert schema definitions for Test Action Group](./alerts-common-schema-test-action-definitions.md).
164
+
> - To find common schema samples for all sample types, see [Alert payload samples](./alerts-payload-samples.md).
165
165
> - To find non-common schema alert definitions, see [Non-common alert schema definitions for Test Action Group](./alerts-non-common-schema-definitions.md).
166
166
167
167
## Create an action group with a Resource Manager template
@@ -479,7 +479,7 @@ If you use the webhook action, your target webhook endpoint must be able to proc
479
479
1. Copy the `$myApp.ObjectId` value that's in the script.
480
480
1. In the webhook action definition, in the **Object Id** box, enter the value that you copied.
481
481
482
-
:::image type="content" source="./media/action-groups/action-groups-secure-webhook.png" alt-text="Screenshot that shows the Secured Webhook dialog in the Azure portal with the Object Id box." border="true":::
482
+
:::image type="content" source="./media/action-groups/action-groups-secure-webhook.png" alt-text="Screenshot that shows the Secured Webhook dialog in the Azure portal with the Object ID box." border="true":::
Copy file name to clipboardExpand all lines: articles/azure-monitor/alerts/activity-log-alerts-webhook.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ For more information on activity log alerts, see how to [create Azure activity l
14
14
For information on action groups, see how to [create action groups](./action-groups.md).
15
15
16
16
> [!NOTE]
17
-
> You can also use the [common alert schema](./alerts-common-schema.md) for your webhook integrations. It provides the advantage of having a single extensible and unified alert payload across all the alert services in Azure Monitor. [Learn about the common alert schema definitions](./alerts-common-schema-definitions.md).
17
+
> You can also use the [common alert schema](./alerts-common-schema.md) for your webhook integrations. It provides the advantage of having a single extensible and unified alert payload across all the alert services in Azure Monitor. [Learn about the common alert schema](./alerts-common-schema.md).
18
18
19
19
## Authenticate the webhook
20
20
@@ -272,7 +272,7 @@ For specific schema details on service health notification activity log alerts,
272
272
| resourceProviderName |The resource provider of the affected resource. |
273
273
| conditionType |Always `Event`. |
274
274
| name |Name of the alert rule. |
275
-
|id|Resource ID of the alert. |
275
+
|ID|Resource ID of the alert. |
276
276
| description |Alert description set when the alert is created. |
277
277
| subscriptionId |Azure subscription ID. |
278
278
| timestamp |Time at which the event was generated by the Azure service that processed the request. |
Copy file name to clipboardExpand all lines: articles/azure-monitor/alerts/alerts-common-schema.md
+70-22Lines changed: 70 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,15 +2,15 @@
2
2
title: Common alert schema for Azure Monitor alerts
3
3
description: Understand the common alert schema, why you should use it, and how to enable it.
4
4
ms.topic: conceptual
5
-
ms.date: 12/22/2022
5
+
ms.date: 02/16/2023
6
6
ms.reviewer: ofmanor
7
7
author: AbbyMSFT
8
8
ms.author: abbyweisberg
9
9
---
10
10
11
11
# Common alert schema
12
12
13
-
The common alert schema standardizes the consumption experience for alert notifications in Azure. Historically, activity log, metric, and log alerts each had their own email templates and webhook schemas. The common alert schema provides one standardized schema for all alert notifications.
13
+
The common alert schema standardizes the consumption of Azure Monitor alert notifications. Historically, activity log, metric, and log alerts each had their own email templates and webhook schemas. The common alert schema provides one standardized schema for all alert notifications.
14
14
15
15
A standardized schema can help you minimize the number of integrations, which simplifies the process of managing and maintaining your integrations.
16
16
@@ -21,7 +21,7 @@ The common alert schema provides a consistent structure for:
21
21
- Azure Functions
22
22
- Azure Automation runbook
23
23
24
-
The new schema enables a richer alert consumption experience across both the Azure portal and the Azure mobile app.
24
+
The new schema enables a richer alert consumption experience in both the Azure portal and the Azure mobile app.
25
25
26
26
> [!NOTE]
27
27
> Alerts generated by [VM insights](../vm/vminsights-overview.md) do not support the common schema.
@@ -87,6 +87,7 @@ The common schema includes information about the affected resource and the cause
87
87
}
88
88
```
89
89
90
+
For sample alerts that use the common schema, see [Sample alert payloads](alerts-payload-samples.md).
90
91
## Essentials fields
91
92
92
93
| Field | Description|
@@ -96,7 +97,7 @@ The common schema includes information about the affected resource and the cause
96
97
| Severity | The severity of the alert. Possible values are Sev0, Sev1, Sev2, Sev3, or Sev4. |
97
98
| signalType | Identifies the signal on which the alert rule was defined. Possible values are Metric, Log, or Activity Log. |
98
99
| monitorCondition | When an alert fires, the alert's monitor condition is set to **Fired**. When the underlying condition that caused the alert to fire clears, the monitor condition is set to **Resolved**. |
99
-
| monitoringService | The monitoring service or solution that generated the alert. The fields for the alert context are dictated by the monitoring service. |
100
+
| monitoringService | The monitoring service or solution that generated the alert. The monitoring service determines which fields are in the alert context. |
100
101
| alertTargetIds | The list of the Azure Resource Manager IDs that are affected targets of an alert. For a log alert defined on a Log Analytics workspace or Application Insights instance, it's the respective workspace or application. |
101
102
| configurationItems |The list of affected resources of an alert.<br>In some cases, the configuration items can be different from the alert targets. For example, in metric-for-log or log alerts defined on a Log Analytics workspace, the configuration items are the actual resources sending the telemetry and not the workspace.<br><ul><li>In the log alerts API (Scheduled Query Rules) v2021-08-01, the `configurationItem` values are taken from explicitly defined dimensions in this priority: `Computer`, `_ResourceId`, `ResourceId`, `Resource`.</li><li>In earlier versions of the log alerts API, the `configurationItem` values are taken implicitly from the results in this priority: `Computer`, `_ResourceId`, `ResourceId`, `Resource`.</li></ul>In ITSM systems, the `configurationItems` field is used to correlate alerts to resources in a configuration management database. |
102
103
| originAlertId | The ID of the alert instance, as generated by the monitoring service generating it. |
@@ -107,9 +108,34 @@ The common schema includes information about the affected resource and the cause
107
108
|alertContextVersion | The version number for the `alertContext` section. |
108
109
109
110
110
-
## Alert context fields for metric alerts
111
-
112
-
### Sample metric alert with a static threshold and the monitoringService = `Platform`
111
+
## Alert context fields for metric alerts
112
+
113
+
|Field |Description |
114
+
|---------|---------|
115
+
|properties |(Optional.) A collection of customer-defined properties. |
116
+
|conditionType |The type of condition selected for the alert rule:<br> - static threshold<br> - dynamic threshold<br> - webtest |
117
+
|condition ||
118
+
|windowSize |The time period analyzed by the alert rule.|
119
+
|allOf |Indicates that all conditions defined in the alert rule must be met to trigger an alert.|
120
+
|alertSensitivity |In an alert rule with a dynamic threshold, indicates how sensitive the rule is, or how much the value can deviate from the upper or lower threshold.|
121
+
|failingPeriods |In an alert rule with a dynamic threshold, the number of evaluation periods that don't meet the alert threshold that will trigger an alert. For example, you can indicate that an alert is triggered when 3 out of the last five evaluation periods aren't within the alert thresholds. |
122
+
|numberOfEvaluationPeriods|The total number of evaluations. |
123
+
|minFailingPeriodsToAlert|The minimum number of evaluations that do no meet the alert rule conditions.|
124
+
|ignoreDataBefore |(Optional.) In an alert rule with a dynamic threshold, the date from which the threshold is calculated. Use this value to indicate that the rule shouldn't calculate the dynamic threshold using data from before the specified date. |
125
+
|metricName |The name of the metric monitored by the alert rule. |
126
+
|metricNamespace |The namespace of the metric monitored by the alert rule. |
127
+
|operator |The logical operator of the alert rule. |
128
+
|threshold |The threshold defined in the alert rule. For an alert rule with a dynamic threshold, this value is the calculated threshold. |
129
+
|timeAggregation |The aggregation type of the alert rule. |
130
+
|dimensions |The metric dimension that triggered the alert. |
131
+
|name |The dimension name. |
132
+
|value |The dimension value. |
133
+
|metricValue |The metric value at the time that it violated the threshold. |
134
+
|webTestName |If the condition type is `webtest`, the name of the webtest. |
135
+
|windowStartTime |The start time of the evaluation window in which the alert fired. |
136
+
|windowEndTime |The end time of the evaluation window in which the alert fired. |
137
+
138
+
### Sample metric alert with a static threshold when the monitoringService = `Platform`
113
139
114
140
```json
115
141
{
@@ -141,7 +167,7 @@ The common schema includes information about the affected resource and the cause
141
167
}
142
168
```
143
169
144
-
### Sample metric alert with a dynamic threshold and the monitoringService = Platform
170
+
### Sample metric alert with a dynamic threshold when the monitoringService = `Platform`
145
171
146
172
```json
147
173
{
@@ -173,7 +199,7 @@ The common schema includes information about the affected resource and the cause
173
199
}
174
200
}
175
201
```
176
-
### Sample metric alert for availability tests and the monitoringService = Platform
202
+
### Sample metric alert for availability tests when the monitoringService = `Platform`
177
203
178
204
```json
179
205
{
@@ -208,6 +234,39 @@ The common schema includes information about the affected resource and the cause
208
234
> - The common schema is not supported for log alerts using webhooks with a custom email subject and/or JSON payload, since the common schema overwrites the custom configurations.
209
235
> - Alerts using the common schema have an upper size limit of 256 KB per alert. If the log alerts payload includes search results that cause the alert to exceed the maximum size, the search results aren't embedded in the log alerts payload. You can check if the payload includes the search results with the `IncludedSearchResults` flag. Use `LinkToFilteredSearchResultsAPI` or `LinkToSearchResultsAPI` to access query results with the [Log Analytics API](/rest/api/loganalytics/dataaccess/query/get) if the search results are not included.
210
236
237
+
|Field |Description |
238
+
|---------|---------|
239
+
|SearchQuery |The query defined in the alert rule. |
240
+
|SearchIntervalStartTimeUtc |The start time of the evaluation window in which the alert fired in UTC. |
241
+
|SearchIntervalEndTimeUtc |The end time of the evaluation window in which the alert fired in UTC. |
242
+
|ResultCount |The number of records returned by the query. For metric measurement rules, the number or records that match the specific dimension combination. |
243
+
|LinkToSearchResults |A link to the search results. |
244
+
|LinkToFilteredSearchResultsUI |For metric measurement rules, the link to the search results after they've been filtered by the dimension combinations. |
245
+
|LinkToSearchResultsAPI |A link to the query results using the Log Analytics API. |
246
+
|LinkToFilteredSearchResultsAPI |For metric measurement rules, the link to the search results using the Log Analytics API after they've been filtered by the dimension combinations. |
247
+
|SearchIntervalDurationMin |The total number of minutes in the search interval. |
248
+
|SearchIntervalInMin |The total number of minutes in the search interval. |
249
+
|Threshold |The threshold defined in the alert rule. |
250
+
|Operator |The operator defined in the alert rule. |
251
+
|ApplicationID |The Application Insights ID on which the alert was triggered. |
252
+
|Dimensions |For metric measurement rules, the metric dimensions on which the alert was triggered. |
253
+
|name |The dimension name. |
254
+
|value |The dimension value. |
255
+
|SearchResults |The complete search results. |
256
+
|table |The table of results in the search results. |
257
+
|name |The name of the table in the search results. |
258
+
|columns |The columns in the table. |
259
+
|name |The name of the column. |
260
+
|type |The type of the column. |
261
+
|rows |The rows in the table. |
262
+
|DataSources |The data sources on which the alert was triggered. |
263
+
|resourceID |The resource ID affected by the alert. |
264
+
|tables |The draft response tables included in the query. |
265
+
|IncludedSearchResults | Flag that indicates if the payload should contain the results. |
266
+
|AlertType |The alert type:<br> - Metric Measurement<br> - Number Of Results |
267
+
268
+
269
+
211
270
### Sample log alert when the monitoringService = Platform
212
271
213
272
```json
@@ -352,7 +411,6 @@ The common schema includes information about the affected resource and the cause
352
411
}
353
412
}
354
413
```
355
-
356
414
### Sample log alert when the monitoringService = Log Alerts V2
357
415
358
416
> [!NOTE]
@@ -399,9 +457,9 @@ The common schema includes information about the affected resource and the cause
399
457
}
400
458
}
401
459
```
402
-
403
460
## Alert context fields for activity log alerts
404
461
462
+
See [Azure activity log event schema](../essentials/activity-log-schema.md) for detailed information about the fields in activity log alerts.
405
463
### Sample activity log alert when the monitoringService = Activity Log - Administrative
406
464
407
465
```json
@@ -427,7 +485,6 @@ The common schema includes information about the affected resource and the cause
427
485
}
428
486
}
429
487
```
430
-
431
488
### Sample activity log alert when the monitoringService = Activity Log - Policy
432
489
433
490
```json
@@ -459,7 +516,6 @@ The common schema includes information about the affected resource and the cause
459
516
}
460
517
}
461
518
```
462
-
463
519
### Sample activity log alert when the monitoringService = Activity Log - Autoscale
464
520
465
521
```json
@@ -488,7 +544,6 @@ The common schema includes information about the affected resource and the cause
488
544
}
489
545
}
490
546
```
491
-
492
547
### Sample activity log alert when the monitoringService = Activity Log - Security
493
548
494
549
```json
@@ -520,7 +575,6 @@ The common schema includes information about the affected resource and the cause
520
575
}
521
576
}
522
577
```
523
-
524
578
### Sample activity log alert when the monitoringService = ServiceHealth
525
579
526
580
```json
@@ -564,7 +618,6 @@ The common schema includes information about the affected resource and the cause
564
618
}
565
619
}
566
620
```
567
-
568
621
### Sample activity log alert when the monitoringService = ResourceHealth
569
622
570
623
```json
@@ -591,9 +644,9 @@ The common schema includes information about the affected resource and the cause
591
644
}
592
645
}
593
646
```
594
-
595
647
## Alert context fields for Prometheus alerts
596
648
649
+
See [Azure Monitor managed service for Prometheus rule groups (preview)](../essentials/prometheus-rule-groups.md) for detailed information about the fields in Prometheus alerts.
597
650
### Sample Prometheus alert
598
651
599
652
```json
@@ -614,7 +667,6 @@ The common schema includes information about the affected resource and the cause
614
667
}
615
668
}
616
669
```
617
-
618
670
## Enable the common alert schema
619
671
620
672
Use action groups in the Azure portal or use the REST API to enable the common alert schema. Schemas are defined at the action level. For example, you must separately enable the schema for an email action and a webhook action.
@@ -628,14 +680,11 @@ Use action groups in the Azure portal or use the REST API to enable the common a
628
680
629
681
1. Open any existing action or a new action in an action group.
630
682
1. Select **Yes** to enable the common alert schema.
631
-
632
683
### Enable the common schema using the REST API
633
684
634
685
You can also use the [Action Groups API](/rest/api/monitor/actiongroups) to opt in to the common alert schema. In the [create or update](/rest/api/monitor/actiongroups/createorupdate) REST API call,
635
686
- Set the "useCommonAlertSchema" flag to `true` to enable the common schema
636
687
- Set the "useCommonAlertSchema" flag to `false` to use the non-common schema for email, webhook, Logic Apps, Azure Functions, or Automation runbook actions.
637
-
638
-
639
688
#### Sample REST API call for using the common schema
640
689
641
690
The following [create or update](/rest/api/monitor/actiongroups/createorupdate) REST API request:
@@ -685,7 +734,6 @@ The following [create or update](/rest/api/monitor/actiongroups/createorupdate)
685
734
"tags": {}
686
735
}
687
736
```
688
-
689
737
## Next steps
690
738
691
739
-[Learn how to create a logic app that uses the common alert schema to handle all your alerts](./alerts-common-schema-integrations.md)
0 commit comments