Microsoft.Insights scheduledQueryRules 2018-04-16

Bicep resource definition

The scheduledQueryRules resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Insights/scheduledQueryRules@2018-04-16' = {
  location: 'string'
  name: 'string'
  properties: {
    action: {
      odata.type: 'string'
      // For remaining properties, see Action objects
    }
    autoMitigate: bool
    description: 'string'
    displayName: 'string'
    enabled: 'string'
    schedule: {
      frequencyInMinutes: int
      timeWindowInMinutes: int
    }
    source: {
      authorizedResources: [
        'string'
      ]
      dataSourceId: 'string'
      query: 'string'
      queryType: 'string'
    }
  }
  tags: {
    {customized property}: 'string'
  }
}

Action objects

Set the odata.type property to specify the type of object.

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction, use:

{
  aznsAction: {
    actionGroup: [
      'string'
    ]
    customWebhookPayload: 'string'
    emailSubject: 'string'
  }
  odata.type: 'Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction'
  severity: 'string'
  throttlingInMin: int
  trigger: {
    metricTrigger: {
      metricColumn: 'string'
      metricTriggerType: 'string'
      threshold: int
      thresholdOperator: 'string'
    }
    threshold: int
    thresholdOperator: 'string'
  }
}

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction, use:

{
  criteria: [
    {
      dimensions: [
        {
          name: 'string'
          operator: 'string'
          values: [
            'string'
          ]
        }
      ]
      metricName: 'string'
    }
  ]
  odata.type: 'Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction'
}

Property Values

Microsoft.Insights/scheduledQueryRules

Action

AlertingAction

AzNsActionGroup

Criteria

Dimension

LogMetricTrigger

LogSearchRule

LogToMetricAction

ResourceTags

Schedule

Source

TriggerCondition

Usage Examples

Bicep Samples

A basic example of deploying AlertingAction Scheduled Query Rules resource within Azure Monitor.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource component 'Microsoft.Insights/components@2020-02-02' = {
  name: resourceName
  location: location
  kind: 'web'
  properties: {
    Application_Type: 'web'
    DisableIpMasking: false
    DisableLocalAuth: false
    ForceCustomerStorageForProfiler: false
    RetentionInDays: 90
    SamplingPercentage: 100
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
  }
}

resource scheduledQueryRule 'Microsoft.Insights/scheduledQueryRules@2021-08-01' = {
  name: resourceName
  location: location
  kind: 'LogAlert'
  properties: {
    autoMitigate: false
    checkWorkspaceAlertsStorageConfigured: false
    criteria: {
      allOf: [
        {
          operator: 'Equal'
          query: ''' requests
| summarize CountByCountry=count() by client_CountryOrRegion
'''
          threshold: 5
          timeAggregation: 'Count'
        }
      ]
    }
    enabled: true
    evaluationFrequency: 'PT5M'
    scopes: [
      component.id
    ]
    severity: 3
    skipQueryValidation: false
    windowSize: 'PT5M'
  }
}

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

ARM template resource definition

The scheduledQueryRules resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following JSON to your template.

{
  "type": "Microsoft.Insights/scheduledQueryRules",
  "apiVersion": "2018-04-16",
  "name": "string",
  "location": "string",
  "properties": {
    "action": {
      "odata.type": "string"
      // For remaining properties, see Action objects
    },
    "autoMitigate": "bool",
    "description": "string",
    "displayName": "string",
    "enabled": "string",
    "schedule": {
      "frequencyInMinutes": "int",
      "timeWindowInMinutes": "int"
    },
    "source": {
      "authorizedResources": [ "string" ],
      "dataSourceId": "string",
      "query": "string",
      "queryType": "string"
    }
  },
  "tags": {
    "{customized property}": "string"
  }
}

Action objects

Set the odata.type property to specify the type of object.

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction, use:

{
  "aznsAction": {
    "actionGroup": [ "string" ],
    "customWebhookPayload": "string",
    "emailSubject": "string"
  },
  "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction",
  "severity": "string",
  "throttlingInMin": "int",
  "trigger": {
    "metricTrigger": {
      "metricColumn": "string",
      "metricTriggerType": "string",
      "threshold": "int",
      "thresholdOperator": "string"
    },
    "threshold": "int",
    "thresholdOperator": "string"
  }
}

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction, use:

{
  "criteria": [
    {
      "dimensions": [
        {
          "name": "string",
          "operator": "string",
          "values": [ "string" ]
        }
      ],
      "metricName": "string"
    }
  ],
  "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction"
}

Property Values

Microsoft.Insights/scheduledQueryRules

Action

AlertingAction

AzNsActionGroup

Criteria

Dimension

LogMetricTrigger

LogSearchRule

LogToMetricAction

ResourceTags

Schedule

Source

TriggerCondition

Usage Examples

Azure Quickstart Templates

The following Azure Quickstart templates deploy this resource type.

Template	Description
Create alert rule for azure business continuity items	This templates creates an alert rule and user assigned MSI. It also assigns the MSI reader access to the subscription so that the alert rule has access to query the required protected items and latest recovery point details.

Terraform (AzAPI provider) resource definition

The scheduledQueryRules resource type can be deployed with operations that target:

• Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Insights/scheduledQueryRules@2018-04-16"
  name = "string"
  parent_id = "string"
  location = "string"
  tags = {
    {customized property} = "string"
  }
  body = {
    properties = {
      action = {
        odata.type = "string"
        // For remaining properties, see Action objects
      }
      autoMitigate = bool
      description = "string"
      displayName = "string"
      enabled = "string"
      schedule = {
        frequencyInMinutes = int
        timeWindowInMinutes = int
      }
      source = {
        authorizedResources = [
          "string"
        ]
        dataSourceId = "string"
        query = "string"
        queryType = "string"
      }
    }
  }
}

Action objects

Set the odata.type property to specify the type of object.

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction, use:

{
  aznsAction = {
    actionGroup = [
      "string"
    ]
    customWebhookPayload = "string"
    emailSubject = "string"
  }
  odata.type = "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction"
  severity = "string"
  throttlingInMin = int
  trigger = {
    metricTrigger = {
      metricColumn = "string"
      metricTriggerType = "string"
      threshold = int
      thresholdOperator = "string"
    }
    threshold = int
    thresholdOperator = "string"
  }
}

For Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction, use:

{
  criteria = [
    {
      dimensions = [
        {
          name = "string"
          operator = "string"
          values = [
            "string"
          ]
        }
      ]
      metricName = "string"
    }
  ]
  odata.type = "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction"
}

Property Values

Microsoft.Insights/scheduledQueryRules

Action

AlertingAction

AzNsActionGroup

Criteria

Dimension

LogMetricTrigger

LogSearchRule

LogToMetricAction

ResourceTags

Schedule

Source

TriggerCondition

Usage Examples

Terraform Samples

A basic example of deploying AlertingAction Scheduled Query Rules resource within Azure Monitor.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "component" {
  type      = "Microsoft.Insights/components@2020-02-02"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    kind = "web"
    properties = {
      Application_Type                = "web"
      DisableIpMasking                = false
      DisableLocalAuth                = false
      ForceCustomerStorageForProfiler = false
      RetentionInDays                 = 90
      SamplingPercentage              = 100
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "scheduledQueryRule" {
  type      = "Microsoft.Insights/scheduledQueryRules@2021-08-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    kind = "LogAlert"
    properties = {
      autoMitigate                          = false
      checkWorkspaceAlertsStorageConfigured = false
      criteria = {
        allOf = [
          {
            dimensions      = null
            operator        = "Equal"
            query           = " requests\n| summarize CountByCountry=count() by client_CountryOrRegion\n"
            threshold       = 5
            timeAggregation = "Count"
          },
        ]
      }
      enabled             = true
      evaluationFrequency = "PT5M"
      scopes = [
        azapi_resource.component.id,
      ]
      severity            = 3
      skipQueryValidation = false
      targetResourceTypes = null
      windowSize          = "PT5M"
    }

  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

A basic example of deploying AlertingAction Scheduled Query Rules resource within Azure Monitor.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "component" {
  type      = "Microsoft.Insights/components@2020-02-02"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    kind = "web"
    properties = {
      Application_Type                = "web"
      DisableIpMasking                = false
      DisableLocalAuth                = false
      ForceCustomerStorageForProfiler = false
      RetentionInDays                 = 90
      SamplingPercentage              = 100
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "scheduledQueryRule" {
  type      = "Microsoft.Insights/scheduledQueryRules@2021-08-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    kind = "LogAlert"
    properties = {
      autoMitigate                          = false
      checkWorkspaceAlertsStorageConfigured = false
      criteria = {
        allOf = [
          {
            dimensions      = null
            operator        = "Equal"
            query           = " requests\n| summarize CountByCountry=count() by client_CountryOrRegion\n"
            threshold       = 5
            timeAggregation = "Count"
          },
        ]
      }
      enabled             = true
      evaluationFrequency = "PT5M"
      scopes = [
        azapi_resource.component.id,
      ]
      severity            = 3
      skipQueryValidation = false
      targetResourceTypes = null
      windowSize          = "PT5M"
    }

  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}