|
2 | 2 | title: Common alert schema for Azure Monitor alerts
|
3 | 3 | description: Understand the common alert schema, why you should use it, and how to enable it.
|
4 | 4 | ms.topic: conceptual
|
5 |
| -ms.date: 12/22/2022 |
| 5 | +ms.date: 02/16/2023 |
6 | 6 | ms.reviewer: ofmanor
|
7 | 7 | author: AbbyMSFT
|
8 | 8 | ms.author: abbyweisberg
|
@@ -113,30 +113,30 @@ For sample alerts that use the common schema, including see
|
113 | 113 |
|
114 | 114 | |Field |Description |
|
115 | 115 | |---------|---------|
|
116 |
| -|properties | | |
117 |
| -|conditionType | | |
118 |
| -|condition | | |
119 |
| -|windowSize | | |
120 |
| -|allOf | | |
121 |
| -|alertSensitivity | | |
122 |
| -|failingPeriods | | |
123 |
| -|numberOfEvaluationPeriods | | |
124 |
| -|minFailingPeriodsToAlert | | |
125 |
| -|ignoreDataBefore | | |
126 |
| -|metricName | | |
127 |
| -|metricNamespace | | |
128 |
| -|operator | | |
129 |
| -|threshold | | |
130 |
| -|timeAggregation | | |
131 |
| -|dimensions | | |
132 |
| -|name | | |
133 |
| -|value | | |
134 |
| -|metricValue | | |
135 |
| -|webTestName | | |
136 |
| -|windowStartTime | | |
137 |
| -|windowEndTime | | |
138 |
| - |
139 |
| -### Sample metric alert with a static threshold and the monitoringService = `Platform` |
| 116 | +|properties |(Optional.) A collection of customer-defined properties. | |
| 117 | +|conditionType |The type of condition selected for the alert rule:<br> - static threshold<br> - dynamic threshold<br> - webtest | |
| 118 | +|condition | | |
| 119 | +|windowSize |The time period analyzed by the alert rule.| |
| 120 | +|allOf |Indicates that all conditions defined in the alert rule must be met to trigger an alert.| |
| 121 | +|alertSensitivity |In an alert rule with a dynamic threshold, indicates how sensitive the rule is, or how much the value can deviate from the upper or lower threshold.| |
| 122 | +|failingPeriods |In an alert rule with a dynamic threshold, the number of evaluation periods that do not meet the alert threshold that trigger an alert. For example, you can indicate that an alert is triggered when 3 out of the last 5 evaluation periods are not within the alert thresholds. | |
| 123 | +|numberOfEvaluationPeriods|The total number of evaluations. | |
| 124 | +|minFailingPeriodsToAlert|The minimum number of evaluations that do no meet the alert rule conditions.| |
| 125 | +|ignoreDataBefore |(Optional.) In an alert rule with a dynamic threshold, the date from which the threshold is calculated. Use this value to indicate that the rule should not calculate the dynamic threshold using data from before the specified date. | |
| 126 | +|metricName |The name of the metric monitored by the alert rule. | |
| 127 | +|metricNamespace |The namespace of the metric monitored by the alert rule. | |
| 128 | +|operator |The logical operator of the alert rule. | |
| 129 | +|threshold |The threshold defined in the alert rule. For an alert rule with a dynamic threshold, this value is the calculated threshold. | |
| 130 | +|timeAggregation |The aggregation type of the alert rule. | |
| 131 | +|dimensions |The metric dimension that triggered the alert. | |
| 132 | +|name |The dimension name. | |
| 133 | +|value |The dimension value. | |
| 134 | +|metricValue |The metric value at the time that it violated the threshold. | |
| 135 | +|webTestName |If the condition type is `webtest`, the name of the webtest. | |
| 136 | +|windowStartTime |The start time of the evaluation window in which the alert fired. | |
| 137 | +|windowEndTime |The end time of the evaluation window in which the alert fired. | |
| 138 | + |
| 139 | +### Sample metric alert with a static threshold when the monitoringService = `Platform` |
140 | 140 |
|
141 | 141 | ```json
|
142 | 142 | {
|
@@ -168,7 +168,7 @@ For sample alerts that use the common schema, including see
|
168 | 168 | }
|
169 | 169 | ```
|
170 | 170 |
|
171 |
| -### Sample metric alert with a dynamic threshold and the monitoringService = Platform |
| 171 | +### Sample metric alert with a dynamic threshold when the monitoringService = `Platform` |
172 | 172 |
|
173 | 173 | ```json
|
174 | 174 | {
|
@@ -200,7 +200,7 @@ For sample alerts that use the common schema, including see
|
200 | 200 | }
|
201 | 201 | }
|
202 | 202 | ```
|
203 |
| -### Sample metric alert for availability tests and the monitoringService = Platform |
| 203 | +### Sample metric alert for availability tests when the monitoringService = `Platform` |
204 | 204 |
|
205 | 205 | ```json
|
206 | 206 | {
|
@@ -237,34 +237,34 @@ For sample alerts that use the common schema, including see
|
237 | 237 |
|
238 | 238 | |Field |Description |
|
239 | 239 | |---------|---------|
|
240 |
| -|SearchQuery | | |
241 |
| -|SearchIntervalStartTimeUtc | | |
242 |
| -|SearchIntervalEndTimeUtc | | |
243 |
| -|ResultCount | | |
244 |
| -|LinkToSearchResults | | |
245 |
| -|LinkToFilteredSearchResultsUI | | |
246 |
| -|LinkToSearchResultsAPI | | |
247 |
| -|LinkToFilteredSearchResultsAPI | | |
248 |
| -|SearchIntervalDurationMin | | |
249 |
| -|SearchIntervalInMin | | |
250 |
| -|Threshold | | |
251 |
| -|Operator | | |
252 |
| -|ApplicationID | | |
253 |
| -|Dimensions | | |
254 |
| -|name | | |
255 |
| -|value | | |
256 |
| -|SearchResults | | |
257 |
| -|table | | |
258 |
| -|name | | |
259 |
| -|columns | | |
260 |
| -|name | | |
261 |
| -|type | | |
262 |
| -|rows | | |
263 |
| -|DataSources | | |
264 |
| -|resourceID | | |
265 |
| -|tables | | |
266 |
| -|IncludedSearchResults | | |
267 |
| -|AlertType | | |
| 240 | +|SearchQuery |The query defined in the alert rule. | |
| 241 | +|SearchIntervalStartTimeUtc |The start time of the evaluation window in which the alert fired in UTC. | |
| 242 | +|SearchIntervalEndTimeUtc |The end time of the evaluation window in which the alert fired in UTC. | |
| 243 | +|ResultCount |The number of records returned by the query. For metric measurement rules, this is the number or records that match the specific dimension combination. | |
| 244 | +|LinkToSearchResults |A link to the search results. | |
| 245 | +|LinkToFilteredSearchResultsUI |For metric measurement rules, the link to the search results after they are filtered by the dimension combinations for which the alert is fired. | |
| 246 | +|LinkToSearchResultsAPI |A link to the query results using the Log Analytics API. | |
| 247 | +|LinkToFilteredSearchResultsAPI |For metric measurement rules, the link to the search results using the Log Analytics API after they are filtered by the dimension combinations for which the alert is fired. | |
| 248 | +|SearchIntervalDurationMin |The total number of minutes in the search interval. | |
| 249 | +|SearchIntervalInMin |The total number of minutes in the search interval. | |
| 250 | +|Threshold |The threshold defined in the alert rule. | |
| 251 | +|Operator |The operator defined in the alert rule. | |
| 252 | +|ApplicationID |The Application Insigths ID on which the alert was triggered. | |
| 253 | +|Dimensions |For metric measurement rules, the metric dimensions on which the alert was triggered. | |
| 254 | +|name |The dimension name. | |
| 255 | +|value |The dimesnion value. | |
| 256 | +|SearchResults |The complete search results. | |
| 257 | +|table |The table of results in the search results. | |
| 258 | +|name |The name of the table in the search results. | |
| 259 | +|columns |The columns in the table. | |
| 260 | +|name |The name of the column. | |
| 261 | +|type |The type of the column. | |
| 262 | +|rows |The rows in the table. | |
| 263 | +|DataSources |The data sources on which the alert was triggered. | |
| 264 | +|resourceID |The resource Id affected by the alert. | |
| 265 | +|tables |The draft response tables included in the query. | |
| 266 | +|IncludedSearchResults | Flag that indicates if the payload should contain the results. | |
| 267 | +|AlertType |The alert type:<br> - Metric Measurement<br> - Number Of Results | |
268 | 268 |
|
269 | 269 |
|
270 | 270 |
|
|
0 commit comments