Skip to content

Commit cd97f34

Browse files
ShawnJacksonShawnJackson
authored
Merge pull request #235290 from paulth1/alerts-articles-batch-9
[AQ] edit pass: alerts-articles-batch-9
2 parents 462dd37 + 17e827a commit cd97f34

File tree

2 files changed

+58
-53
lines changed

2 files changed

+58
-53
lines changed

‎articles/azure-monitor/alerts/alerts-log-webhook.md

Lines changed: 39 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Webhook actions for log alerts in Azure alerts
3-
description: Describes how to configure a log alert pushes with webhook action and available customizations
3+
description: This article describes how to configure log alert pushes with webhook action and available customizations.
44
services: monitoring
55
ms.topic: conceptual
66
ms.date: 2/23/2022
@@ -9,10 +9,13 @@ ms.reviewer: yalavi
99

1010
# Webhook actions for log alert rules
1111

12-
[Log alert](alerts-log.md) supports [configuring webhook action groups](./action-groups.md#webhook). In this article, we'll describe what properties are available. Webhook actions allow you to invoke a single HTTP POST request. The service that's called should support webhooks and know how to use the payload it receives.
12+
[Log alerts](alerts-log.md) support [configuring webhook action groups](./action-groups.md#webhook). In this article, we describe the properties that are available. You can use webhook actions to invoke a single HTTP POST request. The service that's called should support webhooks and know how to use the payload it receives.
1313

14-
> [!NOTE]
15-
> It is recommended you use [common alert schema](../alerts/alerts-common-schema.md) for your webhook integrations. The common alert schema provides the advantage of having a single extensible and unified alert payload across all the alert services in Azure Monitor. For log alerts rules that have a custom JSON payload defined, enabling the common alert schema reverts the payload schema to the one described [here](../alerts/alerts-common-schema.md#alert-context-fields-for-log-alerts). This means that if you want to have a custom JSON payload defined, the webhook can't use the common alert schema. Alerts with the common schema enabled have an upper size limit of 256 KB per alert, bigger alert will not include search results. When the search results aren't included, you should use the `LinkToFilteredSearchResultsAPI` or `LinkToSearchResultsAPI` to access query results via the Log Analytics API.
14+
We recommend that you use [common alert schema](../alerts/alerts-common-schema.md) for your webhook integrations. The common alert schema provides the advantage of having a single extensible and unified alert payload across all the alert services in Azure Monitor.
15+
16+
For log alert rules that have a custom JSON payload defined, enabling the common alert schema reverts the payload schema to the one described in [Common alert schema](../alerts/alerts-common-schema.md#alert-context-fields-for-log-alerts). If you want to have a custom JSON payload defined, the webhook can't use the common alert schema.
17+
18+
Alerts with the common schema enabled have an upper size limit of 256 KB per alert. A bigger alert doesn't include search results. When the search results aren't included, use `LinkToFilteredSearchResultsAPI` or `LinkToSearchResultsAPI` to access query results via the Log Analytics API.
1619

1720
## Sample payloads
1821
This section shows sample payloads for webhooks for log alerts. The sample payloads include examples when the payload is standard and when it's custom.
@@ -86,7 +89,7 @@ The following sample payload is for a standard webhook when it's used for log al
8689
The following sample payload is for a standard webhook action that's used for alerts based on Log Analytics:
8790

8891
> [!NOTE]
89-
> The "Severity" field value changes if you've [switched to the current scheduledQueryRules API](/previous-versions/azure/azure-monitor/alerts/alerts-log-api-switch) from the [legacy Log Analytics Alert API](./api-alerts.md).
92+
> The `"Severity"` field value changes if you've [switched to the current scheduledQueryRules API](/previous-versions/azure/azure-monitor/alerts/alerts-log-api-switch) from the [legacy Log Analytics Alert API](./api-alerts.md).
9093
9194
```json
9295
{
@@ -222,56 +225,59 @@ The following sample payload is for a standard webhook when it's used for log al
222225
### Log alert with a custom JSON payload (up to API version `2018-04-16`)
223226

224227
> [!NOTE]
225-
> Custom JSON-based webhook is not supported from API version `2021-08-01`.
228+
> A custom JSON-based webhook isn't supported from API version `2021-08-01`.
226229
227-
Default webhook action properties and their custom JSON parameter names:
230+
The following table lists default webhook action properties and their custom JSON parameter names.
228231

229232
| Parameter | Variable | Description |
230233
|:--- |:--- |:--- |
231-
| *AlertRuleName* |#alertrulename |Name of the alert rule. |
232-
| *Severity* |#severity |Severity set for the fired log alert. |
233-
| *AlertThresholdOperator* |#thresholdoperator |Threshold operator for the alert rule. |
234-
| *AlertThresholdValue* |#thresholdvalue |Threshold value for the alert rule. |
235-
| *LinkToSearchResults* |#linktosearchresults |Link to the Analytics portal that returns the records from the query that created the alert. |
236-
| *LinkToSearchResultsAPI* |#linktosearchresultsapi |Link to the Analytics API that returns the records from the query that created the alert. |
237-
| *LinkToFilteredSearchResultsUI* |#linktofilteredsearchresultsui |Link to the Analytics portal that returns the records from the query filtered by dimensions value combinations that created the alert. |
238-
| *LinkToFilteredSearchResultsAPI* |#linktofilteredsearchresultsapi |Link to the Analytics API that returns the records from the query filtered by dimensions value combinations that created the alert. |
239-
| *ResultCount* |#searchresultcount |Number of records in the search results. |
240-
| *Search Interval End time* |#searchintervalendtimeutc |End time for the query in UTC, with the format mm/dd/yyyy HH:mm:ss AM/PM. |
241-
| *Search Interval* |#searchinterval |Time window for the alert rule, with the format HH:mm:ss. |
242-
| *Search Interval StartTime* |#searchintervalstarttimeutc |Start time for the query in UTC, with the format mm/dd/yyyy HH:mm:ss AM/PM.
243-
| *SearchQuery* |#searchquery |Log search query used by the alert rule. |
244-
| *SearchResults* |"IncludeSearchResults": true|Records returned by the query as a JSON table, limited to the first 1,000 records. "IncludeSearchResults": true is added in a custom JSON webhook definition as a top-level property. |
245-
| *Dimensions* |"IncludeDimensions": true|Dimensions value combinations that triggered that alert as a JSON section. "IncludeDimensions": true is added in a custom JSON webhook definition as a top-level property. |
246-
| *Alert Type*| #alerttype | The type of log alert rule configured as [Metric measurement or Number of results](./alerts-unified-log.md#measure).|
247-
| *WorkspaceID* |#workspaceid |ID of your Log Analytics workspace. |
248-
| *Application ID* |#applicationid |ID of your Application Insights app. |
249-
| *Subscription ID* |#subscriptionid |ID of your Azure subscription used. |
234+
| `AlertRuleName` |#alertrulename |Name of the alert rule. |
235+
| `Severity` |#severity |Severity set for the fired log alert. |
236+
| `AlertThresholdOperator` |#thresholdoperator |Threshold operator for the alert rule. |
237+
| `AlertThresholdValue` |#thresholdvalue |Threshold value for the alert rule. |
238+
| `LinkToSearchResults` |#linktosearchresults |Link to the Analytics portal that returns the records from the query that created the alert. |
239+
| `LinkToSearchResultsAPI` |#linktosearchresultsapi |Link to the Analytics API that returns the records from the query that created the alert. |
240+
| `LinkToFilteredSearchResultsUI` |#linktofilteredsearchresultsui |Link to the Analytics portal that returns the records from the query filtered by dimensions value combinations that created the alert. |
241+
| `LinkToFilteredSearchResultsAPI` |#linktofilteredsearchresultsapi |Link to the Analytics API that returns the records from the query filtered by dimensions value combinations that created the alert. |
242+
| `ResultCount` |#searchresultcount |Number of records in the search results. |
243+
| `Search Interval End time` |#searchintervalendtimeutc |End time for the query in UTC, with the format mm/dd/yyyy HH:mm:ss AM/PM. |
244+
| `Search Interval` |#searchinterval |Time window for the alert rule, with the format HH:mm:ss. |
245+
| `Search Interval StartTime` |#searchintervalstarttimeutc |Start time for the query in UTC, with the format mm/dd/yyyy HH:mm:ss AM/PM.
246+
| `SearchQuery` |#searchquery |Log search query used by the alert rule. |
247+
| `SearchResults` |"IncludeSearchResults": true|Records returned by the query as a JSON table, limited to the first 1,000 records. "IncludeSearchResults": true is added in a custom JSON webhook definition as a top-level property. |
248+
| `Dimensions` |"IncludeDimensions": true|Dimensions value combinations that triggered that alert as a JSON section. "IncludeDimensions": true is added in a custom JSON webhook definition as a top-level property. |
249+
| `Alert Type`| #alerttype | The type of log alert rule configured as [Metric measurement or Number of results](./alerts-unified-log.md#measure).|
250+
| `WorkspaceID` |#workspaceid |ID of your Log Analytics workspace. |
251+
| `Application ID` |#applicationid |ID of your Application Insights app. |
252+
| `Subscription ID` |#subscriptionid |ID of your Azure subscription used. |
250253

251-
You can use the **Include custom JSON payload for webhook** to get a custom JSON payload using the parameters. You can also generate additional properties.
252-
For example, you might specify the following custom payload that includes a single parameter called *text*. The service that this webhook calls expects this parameter:
254+
You can use **Include custom JSON payload for webhook** to get a custom JSON payload by using the parameters. You can also generate more properties.
255+
256+
For example, you might specify the following custom payload that includes a single parameter called `text`. The service that this webhook calls expects this parameter:
253257

254258
```json
255259

256260
{
257261
"text":"#alertrulename fired with #searchresultcount over threshold of #thresholdvalue."
258262
}
259263
```
260-
This example payload resolves to something like the following when it's sent to the webhook:
264+
265+
This example payload resolves to something like the following example when it's sent to the webhook:
261266

262267
```json
263268
{
264269
"text":"My Alert Rule fired with 18 records over threshold of 10 ."
265270
}
266271
```
267-
Variables in a custom webhook must be specified within a JSON enclosure. For example, referencing "#searchresultcount" in the webhook example will output based on the alert results.
268272

269-
To include search results, add **IncludeSearchResults** as a top-level property in the custom JSON. Search results are included as a JSON structure, so results can't be referenced in custom defined fields.
273+
Variables in a custom webhook must be specified within a JSON enclosure. For example, referencing `#searchresultcount` in the webhook example generates output based on the alert results.
274+
275+
To include search results, add **IncludeSearchResults** as a top-level property in the custom JSON. Search results are included as a JSON structure, so results can't be referenced in custom-defined fields.
270276

271277
> [!NOTE]
272-
> The **View Webhook** button next to the **Include custom JSON payload for webhook** option displays preview of what was provided. It doesn't contain actual data, but is representative of the JSON schema that will be used.
278+
> The **View Webhook** button next to the **Include custom JSON payload for webhook** option displays a preview of what was provided. It doesn't contain actual data but is representative of the JSON schema that will be used.
273279
274-
For example, to create a custom payload that includes just the alert name and the search results, use this configuration:
280+
For example, to create a custom payload that includes only the alert name and the search results, use this configuration:
275281

276282
```json
277283
{

‎articles/azure-monitor/alerts/proactive-diagnostics.md

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Smart detection in Azure Application Insights | Microsoft Docs
3-
description: Application Insights performs automatic deep analysis of your app telemetry and warns you of potential problems.
2+
title: Smart detection in Application Insights | Microsoft Docs
3+
description: Application Insights performs automatic deep analysis of your app telemetry and warns you about potential problems.
44
ms.topic: conceptual
55
ms.date: 02/07/2019
66
ms.reviewer: yagil
@@ -9,55 +9,54 @@ ms.reviewer: yagil
99
# Smart detection in Application Insights
1010

1111
>[!NOTE]
12-
>You can migrate smart detection on your Application Insights resource to be based on alerts. The migration creates alert rules for the different smart detection modules. Once created, you can manage and configure these rules just like any other Azure Monitor alert rules. You can also configure action groups for these rules, thus enabling multiple methods of taking actions or triggering notification on new detections.
12+
>You can migrate smart detection on your Application Insights resource to be based on alerts. The migration creates alert rules for the different smart detection modules. After it's created, you can manage and configure these rules like any other Azure Monitor alert rules. You can also configure action groups for these rules to enable multiple methods of taking actions or triggering notification on new detections.
1313
>
14-
> For more information, see [Smart Detection Alerts migration](./alerts-smart-detections-migration.md).
14+
> For more information, see [Smart detection alerts migration](./alerts-smart-detections-migration.md).
1515
16-
Smart detection automatically warns you of potential performance problems and failure anomalies in your web application. It performs proactive analysis of the telemetry that your app sends to [Application Insights](../app/app-insights-overview.md). If there is a sudden rise in failure rates, or abnormal patterns in client or server performance, you get an alert. This feature needs no configuration. It operates if your application sends enough telemetry.
16+
Smart detection automatically warns you of potential performance problems and failure anomalies in your web application. It performs proactive analysis of the telemetry that your app sends to [Application Insights](../app/app-insights-overview.md). If there's a sudden rise in failure rates or abnormal patterns in client or server performance, you get an alert. This feature needs no configuration. It operates if your application sends enough telemetry.
1717

18-
You can access the detections issued by smart detection both from the emails you receive, and from the smart detection pane.
18+
You can access the detections issued by smart detection from the emails you receive and from the smart detection pane.
1919

2020
## Review your smart detections
2121
You can discover detections in two ways:
2222

2323
* **You receive an email** from Application Insights. Here's a typical example:
2424

25-
![Email alert](./media/proactive-diagnostics/03.png)
25+
![Screenshot that shows an email alert.](./media/proactive-diagnostics/03.png)
2626

27-
Click the large button to open more detail in the portal.
28-
* **The smart detection pane** in Application Insights. Select **Smart detection** under the **Investigate** menu to see a list of recent detections.
27+
Select **See the analysis of this issue** to see more information in the portal.
28+
* **The smart detection pane** in Application Insights. Under the **Investigate** menu, select **Smart Detection** to see a list of recent detections.
2929

30-
![View recent detections](./media/proactive-diagnostics/04.png)
30+
![Screenshot that shows recent detections.](./media/proactive-diagnostics/04.png)
3131

3232
Select a detection to view its details.
3333

3434
## What problems are detected?
3535

36-
Smart detection detects and notifies about various issues, such as:
36+
Smart detection detects and notifies you about various issues:
3737

38-
* [Smart detection - Failure Anomalies](./proactive-failure-diagnostics.md). We use machine learning to set the expected rate of failed requests for your app, correlating with load, and other factors. Notifies if the failure rate goes outside the expected envelope.
39-
* [Smart detection - Performance Anomalies](./smart-detection-performance.md). Notifies if response time of an operation or dependency duration is slowing down, compared to historical baseline. It also notifies if we identify an anomalous pattern in response time, or page load time.
40-
* General degradations and issues, like [Trace degradation](./proactive-trace-severity.md), [Memory leak](./proactive-potential-memory-leak.md), [Abnormal rise in Exception volume](./proactive-exception-volume.md) and [Security anti-patterns](./proactive-application-security-detection-pack.md).
38+
* [Smart detection - Failure Anomalies](./proactive-failure-diagnostics.md): Notifies if the failure rate goes outside the expected envelope. We use machine learning to set the expected rate of failed requests for your app, correlating with load and other factors.
39+
* [Smart detection - Performance Anomalies](./smart-detection-performance.md): Notifies if response time of an operation or dependency duration is slowing down compared to the historical baseline. It also notifies if we identify an anomalous pattern in response time or page load time.
40+
* **General degradations and issues**: [Trace degradation](./proactive-trace-severity.md), [Memory leak](./proactive-potential-memory-leak.md), [Abnormal rise in Exception volume](./proactive-exception-volume.md), and [Security anti-patterns](./proactive-application-security-detection-pack.md).
4141

42-
(The help links in each notification take you to the relevant articles.)
42+
The help links in each notification take you to the relevant articles.
4343

4444
## Smart detection email notifications
4545

4646
All smart detection rules, except for rules marked as _preview_, are configured by default to send email notifications when detections are found.
4747

48-
Configuring email notifications for a specific smart detection rule can be done by opening the smart detection **Settings** pane and selecting the rule, which will open the **Edit rule** pane.
49-
50-
Alternatively, you can change the configuration using Azure Resource Manager templates. For more information, see [Manage Application Insights smart detection rules using Azure Resource Manager templates](./proactive-arm-config.md) for more details.
48+
You can configure email notifications for a specific smart detection rule. On the smart detection **Settings** pane, select the rule to open the **Edit rule** pane.
5149

50+
Alternatively, you can change the configuration by using Azure Resource Manager templates. For more information, see [Manage Application Insights smart detection rules by using Azure Resource Manager templates](./proactive-arm-config.md).
5251

5352
## Next steps
5453
These diagnostic tools help you inspect the telemetry from your app:
5554

5655
* [Metric explorer](../essentials/metrics-charts.md)
5756
* [Search explorer](../app/diagnostic-search.md)
58-
* [Analytics - powerful query language](../logs/log-analytics-tutorial.md)
57+
* [Analytics: Powerful query language](../logs/log-analytics-tutorial.md)
5958

60-
Smart Detection is automatic. But maybe you'd like to set up some more alerts?
59+
Smart detection is automatic, but if you want to set up more alerts, see:
6160

6261
* [Manually configured metric alerts](./alerts-log.md)
6362
* [Availability web tests](/previous-versions/azure/azure-monitor/app/monitor-web-app-availability)

0 commit comments

Comments
 (0)