2

I have a .net application uploading customEvents to application insights. I'd like to create an alert to trigger when a scanning (like a heartbeat) message hasn't been sent.

If I run the following log query I get back what I think looks like something I can alert on:

app('dev-insights').customEvents
| where name == "Scanning"
| project-rename TimeGenerated = timestamp
| make-series kind=nonempty counts=count() default=0
              on TimeGenerated in range(ago(1h), now()-5m, 5m) 
| mv-expand TimeGenerated, counts
| project todatetime(TimeGenerated), toint(counts)
| summarize AggregatedValue=avg(counts) by bin(TimeGenerated, 5m)

And I get results like this:

enter image description here

But with the following in azure alerts it never seems to fire:

enter image description here

Is this something that should be possible? I notice that the graph in the alert preview never looks right which I suspect is something to do with the issue, but seeing as the raw log query looks ok I'm a bit stuck.

Ideally I guess I'd prefer this to be a metric alert as I think if even I can get this to work I'll get an alert sent every time the condition is true rather than just one when it triggers and one when it resolves. Is there any way to achieve that?

mattb
  • 384
  • 1
  • 4
  • 24
  • Can you try changing "Period (in minutes)" to 15? Yes, at this point Log Search Alerts rules are stateless. If you'd like autoresolution then for now the recommendation is to use Metrics alerts. – ZakiMa Oct 22 '20 at 00:48
  • Thanks, I realised that I had over complicated my search, i'd taken it from my grafana series where I needed to fill in missing values. What I actually needed was to check for the presense of a message so I could use ```customEvents | where name == "Scanning" | summarize AggregatedValue=count() by bin(timestamp, 1m)``` – mattb Oct 22 '20 at 07:06
  • on metric alerts how do you use them on customEvents data from applications insights, I haven't seen an example of that. – mattb Oct 22 '20 at 07:07
  • You can alert on a metric. Application Insights extracts customMeasurements from customEvents and converts them to metrics. – ZakiMa Oct 22 '20 at 07:09
  • @ZakiMa, please post your comment as an answer:). – Ivan Glasenberg Oct 29 '20 at 02:36

0 Answers0