scheduled_query_rules

Creates, updates, deletes, gets or lists a scheduled_query_rules resource.

Overview

Name	scheduled_query_rules
Type	Resource
Id	azure.monitor.scheduled_query_rules

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actions	object	Actions to invoke when the alert fires.
autoMitigate	boolean	The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of kinds LogAlert and SimpleLogAlert.
checkWorkspaceAlertsStorageConfigured	boolean	The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.
createdWithApiVersion	string	The api-version used when creating this alert rule.
criteria	object	The rule criteria that defines the conditions of the scheduled query rule.
description	string	The description of the scheduled query rule.
displayName	string	The display name of the alert rule.
enabled	boolean	The flag which indicates whether this scheduled query rule is enabled. Value should be true or false.
etag	string	Resource entity tag (ETag).
evaluationFrequency	string	How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.
identity	object	The identity of the resource.
isLegacyLogAnalyticsRule	boolean	True if alert rule is legacy Log Analytic rule.
isWorkspaceAlertsStorageConfigured	boolean	The flag which indicates whether this scheduled query rule has been configured to be stored in the customer's storage. The default is false.
kind	string	Indicates the type of scheduled query rule. The default is LogAlert. Known values are: "LogAlert", "SimpleLogAlert", and "LogToMetric". (LogAlert, SimpleLogAlert, LogToMetric)
location	string	The geo-location where the resource lives. Required.
muteActionsDuration	string	Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.
overrideQueryTimeRange	string	If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.
resolveConfiguration	object	Defines the configuration for resolving fired alerts. Relevant only for rules of kinds LogAlert and SimpleLogAlert.
scopes	array	The list of resource id's that this scheduled query rule is scoped to.
severity	object	Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert. Known values are: 0, 1, 2, 3, and 4.
skipQueryValidation	boolean	The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
targetResourceTypes	array	List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
windowSize	string	The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.

list_by_resource_group

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actions	object	Actions to invoke when the alert fires.
autoMitigate	boolean	The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of kinds LogAlert and SimpleLogAlert.
checkWorkspaceAlertsStorageConfigured	boolean	The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.
createdWithApiVersion	string	The api-version used when creating this alert rule.
criteria	object	The rule criteria that defines the conditions of the scheduled query rule.
description	string	The description of the scheduled query rule.
displayName	string	The display name of the alert rule.
enabled	boolean	The flag which indicates whether this scheduled query rule is enabled. Value should be true or false.
etag	string	Resource entity tag (ETag).
evaluationFrequency	string	How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.
identity	object	The identity of the resource.
isLegacyLogAnalyticsRule	boolean	True if alert rule is legacy Log Analytic rule.
isWorkspaceAlertsStorageConfigured	boolean	The flag which indicates whether this scheduled query rule has been configured to be stored in the customer's storage. The default is false.
kind	string	Indicates the type of scheduled query rule. The default is LogAlert. Known values are: "LogAlert", "SimpleLogAlert", and "LogToMetric". (LogAlert, SimpleLogAlert, LogToMetric)
location	string	The geo-location where the resource lives. Required.
muteActionsDuration	string	Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.
overrideQueryTimeRange	string	If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.
resolveConfiguration	object	Defines the configuration for resolving fired alerts. Relevant only for rules of kinds LogAlert and SimpleLogAlert.
scopes	array	The list of resource id's that this scheduled query rule is scoped to.
severity	object	Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert. Known values are: 0, 1, 2, 3, and 4.
skipQueryValidation	boolean	The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
targetResourceTypes	array	List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
windowSize	string	The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.

list_by_subscription

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
actions	object	Actions to invoke when the alert fires.
autoMitigate	boolean	The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of kinds LogAlert and SimpleLogAlert.
checkWorkspaceAlertsStorageConfigured	boolean	The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.
createdWithApiVersion	string	The api-version used when creating this alert rule.
criteria	object	The rule criteria that defines the conditions of the scheduled query rule.
description	string	The description of the scheduled query rule.
displayName	string	The display name of the alert rule.
enabled	boolean	The flag which indicates whether this scheduled query rule is enabled. Value should be true or false.
etag	string	Resource entity tag (ETag).
evaluationFrequency	string	How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.
identity	object	The identity of the resource.
isLegacyLogAnalyticsRule	boolean	True if alert rule is legacy Log Analytic rule.
isWorkspaceAlertsStorageConfigured	boolean	The flag which indicates whether this scheduled query rule has been configured to be stored in the customer's storage. The default is false.
kind	string	Indicates the type of scheduled query rule. The default is LogAlert. Known values are: "LogAlert", "SimpleLogAlert", and "LogToMetric". (LogAlert, SimpleLogAlert, LogToMetric)
location	string	The geo-location where the resource lives. Required.
muteActionsDuration	string	Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.
overrideQueryTimeRange	string	If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.
resolveConfiguration	object	Defines the configuration for resolving fired alerts. Relevant only for rules of kinds LogAlert and SimpleLogAlert.
scopes	array	The list of resource id's that this scheduled query rule is scoped to.
severity	object	Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert. Known values are: 0, 1, 2, 3, and 4.
skipQueryValidation	boolean	The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
targetResourceTypes	array	List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
windowSize	string	The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, rule_name, subscription_id		Retrieve an scheduled query rule definition.
list_by_resource_group	select	resource_group_name, subscription_id		Retrieve scheduled query rule definitions in a resource group.
list_by_subscription	select	subscription_id		Retrieve a scheduled query rule definitions in a subscription.
create_or_update	insert	resource_group_name, rule_name, subscription_id, properties, location		Creates or updates a scheduled query rule.
update	update	resource_group_name, rule_name, subscription_id		Update a scheduled query rule.
create_or_update	replace	resource_group_name, rule_name, subscription_id, properties, location		Creates or updates a scheduled query rule.
delete	delete	resource_group_name, rule_name, subscription_id		Deletes a scheduled query rule.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
rule_name	string	The name of the rule. Required.
subscription_id	string

SELECT examples

get

Retrieve an scheduled query rule definition.

SELECT
id,
name,
actions,
autoMitigate,
checkWorkspaceAlertsStorageConfigured,
createdWithApiVersion,
criteria,
description,
displayName,
enabled,
etag,
evaluationFrequency,
identity,
isLegacyLogAnalyticsRule,
isWorkspaceAlertsStorageConfigured,
kind,
location,
muteActionsDuration,
overrideQueryTimeRange,
resolveConfiguration,
scopes,
severity,
skipQueryValidation,
systemData,
tags,
targetResourceTypes,
type,
windowSize
FROM azure.monitor.scheduled_query_rules
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND rule_name = '{{ rule_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_by_resource_group

Retrieve scheduled query rule definitions in a resource group.

SELECT
id,
name,
actions,
autoMitigate,
checkWorkspaceAlertsStorageConfigured,
createdWithApiVersion,
criteria,
description,
displayName,
enabled,
etag,
evaluationFrequency,
identity,
isLegacyLogAnalyticsRule,
isWorkspaceAlertsStorageConfigured,
kind,
location,
muteActionsDuration,
overrideQueryTimeRange,
resolveConfiguration,
scopes,
severity,
skipQueryValidation,
systemData,
tags,
targetResourceTypes,
type,
windowSize
FROM azure.monitor.scheduled_query_rules
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_by_subscription

Retrieve a scheduled query rule definitions in a subscription.

SELECT
id,
name,
actions,
autoMitigate,
checkWorkspaceAlertsStorageConfigured,
createdWithApiVersion,
criteria,
description,
displayName,
enabled,
etag,
evaluationFrequency,
identity,
isLegacyLogAnalyticsRule,
isWorkspaceAlertsStorageConfigured,
kind,
location,
muteActionsDuration,
overrideQueryTimeRange,
resolveConfiguration,
scopes,
severity,
skipQueryValidation,
systemData,
tags,
targetResourceTypes,
type,
windowSize
FROM azure.monitor.scheduled_query_rules
WHERE subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Creates or updates a scheduled query rule.

INSERT INTO azure.monitor.scheduled_query_rules (
properties,
identity,
tags,
location,
kind,
resource_group_name,
rule_name,
subscription_id
)
SELECT 
'{{ properties }}' /* required */,
'{{ identity }}',
'{{ tags }}',
'{{ location }}' /* required */,
'{{ kind }}',
'{{ resource_group_name }}',
'{{ rule_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
identity,
kind,
location,
properties,
systemData,
tags,
type
;

Manifest

# Description fields are for documentation purposes
- name: scheduled_query_rules
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the scheduled_query_rules resource.
  - name: rule_name
    value: "{{ rule_name }}"
    description: Required parameter for the scheduled_query_rules resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the scheduled_query_rules resource.
  - name: properties
    description: |
      The rule properties of the resource. Required.
    value:
      createdWithApiVersion: "{{ createdWithApiVersion }}"
      isLegacyLogAnalyticsRule: {{ isLegacyLogAnalyticsRule }}
      description: "{{ description }}"
      displayName: "{{ displayName }}"
      severity: "{{ severity }}"
      enabled: {{ enabled }}
      scopes:
        - "{{ scopes }}"
      evaluationFrequency: "{{ evaluationFrequency }}"
      windowSize: "{{ windowSize }}"
      overrideQueryTimeRange: "{{ overrideQueryTimeRange }}"
      targetResourceTypes:
        - "{{ targetResourceTypes }}"
      criteria:
        allOf:
          - criterionType: "{{ criterionType }}"
            query: "{{ query }}"
            timeAggregation: "{{ timeAggregation }}"
            metricMeasureColumn: "{{ metricMeasureColumn }}"
            resourceIdColumn: "{{ resourceIdColumn }}"
            dimensions: "{{ dimensions }}"
            operator: "{{ operator }}"
            threshold: {{ threshold }}
            alertSensitivity: "{{ alertSensitivity }}"
            ignoreDataBefore: "{{ ignoreDataBefore }}"
            failingPeriods:
              numberOfEvaluationPeriods: {{ numberOfEvaluationPeriods }}
              minFailingPeriodsToAlert: {{ minFailingPeriodsToAlert }}
            metricName: "{{ metricName }}"
            minRecurrenceCount: {{ minRecurrenceCount }}
      muteActionsDuration: "{{ muteActionsDuration }}"
      actions:
        actionGroups:
          - "{{ actionGroups }}"
        customProperties: "{{ customProperties }}"
        actionProperties: "{{ actionProperties }}"
      isWorkspaceAlertsStorageConfigured: {{ isWorkspaceAlertsStorageConfigured }}
      checkWorkspaceAlertsStorageConfigured: {{ checkWorkspaceAlertsStorageConfigured }}
      skipQueryValidation: {{ skipQueryValidation }}
      autoMitigate: {{ autoMitigate }}
      resolveConfiguration:
        autoResolved: {{ autoResolved }}
        timeToResolve: "{{ timeToResolve }}"
  - name: identity
    description: |
      The identity of the resource.
    value:
      principalId: "{{ principalId }}"
      tenantId: "{{ tenantId }}"
      type: "{{ type }}"
      userAssignedIdentities: "{{ userAssignedIdentities }}"
  - name: tags
    value: "{{ tags }}"
    description: |
      Resource tags.
  - name: location
    value: "{{ location }}"
    description: |
      The geo-location where the resource lives. Required.
  - name: kind
    value: "{{ kind }}"
    description: |
      Indicates the type of scheduled query rule. The default is LogAlert. Known values are: "LogAlert", "SimpleLogAlert", and "LogToMetric".
    valid_values: ['LogAlert', 'SimpleLogAlert', 'LogToMetric']

UPDATE examples

update

Update a scheduled query rule.

UPDATE azure.monitor.scheduled_query_rules
SET 
identity = '{{ identity }}',
tags = '{{ tags }}',
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND rule_name = '{{ rule_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
identity,
kind,
location,
properties,
systemData,
tags,
type;

REPLACE examples

create_or_update

Creates or updates a scheduled query rule.

REPLACE azure.monitor.scheduled_query_rules
SET 
properties = '{{ properties }}',
identity = '{{ identity }}',
tags = '{{ tags }}',
location = '{{ location }}',
kind = '{{ kind }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND rule_name = '{{ rule_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
AND properties = '{{ properties }}' --required
AND location = '{{ location }}' --required
RETURNING
id,
name,
etag,
identity,
kind,
location,
properties,
systemData,
tags,
type;

DELETE examples

delete

Deletes a scheduled query rule.

DELETE FROM azure.monitor.scheduled_query_rules
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND rule_name = '{{ rule_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;