Scheduled Query Rules - Get

Service:: Monitor

API Version:: 2021-08-01

Retrieve an scheduled query rule definition.

GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/scheduledQueryRules/{ruleName}?api-version=2021-08-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
ruleName	path	True	string	The name of the rule.
subscriptionId	path	True	string minLength: 1	The ID of the target subscription.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	ScheduledQueryRuleResource	Successful request to get a scheduled query rule
Other Status Codes	ErrorContract	BadRequest

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Get a scheduled query rule for single resource

Sample request

HTTP

GET https://management.azure.com/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourceGroups/QueryResourceGroupName/providers/Microsoft.Insights/scheduledQueryRules/perf?api-version=2021-08-01

Sample response

Status code:: 200

{
  "id": "/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourcegroups/QueryResourceGroupName/providers/microsoft.insights/scheduledqueryrules/perf",
  "name": "perf",
  "type": "microsoft.insights/scheduledqueryrules",
  "location": "eastus",
  "tags": {},
  "properties": {
    "description": "Performance rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147/resourceGroups/scopeResourceGroup1/providers/Microsoft.Compute/virtualMachines/vm1"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\"",
          "timeAggregation": "Average",
          "metricMeasureColumn": "% Processor Time",
          "resourceIdColumn": "resourceId",
          "dimensions": [
            {
              "name": "ComputerIp",
              "operator": "Exclude",
              "values": [
                "192.168.1.1"
              ]
            },
            {
              "name": "OSType",
              "operator": "Include",
              "values": [
                "*"
              ]
            }
          ],
          "operator": "GreaterThan",
          "threshold": 70,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "isWorkspaceAlertsStorageConfigured": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}

Definitions

Name	Description
Actions	Actions to invoke when the alert fires.
AlertSeverity	Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.
Condition	A condition of the scheduled query rule.
conditionOperator	The criteria operator. Relevant and required only for rules of the kind LogAlert.
createdByType	The type of identity that created the resource.
Dimension	Dimension splitting and filtering definition
dimensionOperator	Operator for dimension values
ErrorAdditionalInfo	The resource management error additional info.
ErrorContract	Describes the format of Error response.
ErrorResponse	Error Response
FailingPeriods	The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.
Kind	Indicates the type of scheduled query rule. The default is LogAlert.
ScheduledQueryRuleCriteria	The rule criteria that defines the conditions of the scheduled query rule.
ScheduledQueryRuleResource	The scheduled query rule resource.
systemData	Metadata pertaining to creation and last modification of the resource.
timeAggregation	Aggregation type. Relevant and required only for rules of the kind LogAlert.

Actions

Object

Actions to invoke when the alert fires.

Name	Type	Description
actionGroups	string[]	Action Group resource Ids to invoke when the alert fires.
customProperties	object	The properties of an alert payload.

AlertSeverity

Enumeration

Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.

Value	Description
0
1
2
3
4

Condition

Object

A condition of the scheduled query rule.

Name	Type	Description
dimensions	Dimension[]	List of Dimensions conditions
failingPeriods	FailingPeriods	The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.
metricMeasureColumn	string	The column containing the metric measure number. Relevant only for rules of the kind LogAlert.
metricName	string	The name of the metric to be sent. Relevant and required only for rules of the kind LogToMetric.
operator	conditionOperator	The criteria operator. Relevant and required only for rules of the kind LogAlert.
query	string	Log query alert
resourceIdColumn	string	The column containing the resource id. The content of the column must be a uri formatted as resource id. Relevant only for rules of the kind LogAlert.
threshold	number (double)	the criteria threshold value that activates the alert. Relevant and required only for rules of the kind LogAlert.
timeAggregation	timeAggregation	Aggregation type. Relevant and required only for rules of the kind LogAlert.

conditionOperator

Enumeration

The criteria operator. Relevant and required only for rules of the kind LogAlert.

Value	Description
Equals
GreaterThan
GreaterThanOrEqual
LessThan
LessThanOrEqual

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

Dimension

Object

Dimension splitting and filtering definition

Name	Type	Description
name	string	Name of the dimension
operator	dimensionOperator	Operator for dimension values
values	string[]	List of dimension values

dimensionOperator

Enumeration

Operator for dimension values

Value	Description
Include
Exclude

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorContract

Object

Describes the format of Error response.

Name	Type	Description
error	ErrorResponse	Error Response The error details.

ErrorResponse

Object

Error Response

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorResponse[]	The error details.
message	string	The error message.
target	string	The error target.

FailingPeriods

Object

The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.

Name	Type	Default value	Description
minFailingPeriodsToAlert	integer (int64)	1	The number of violations to trigger an alert. Should be smaller or equal to numberOfEvaluationPeriods. Default value is 1
numberOfEvaluationPeriods	integer (int64)	1	The number of aggregated lookback points. The lookback time window is calculated based on the aggregation granularity (windowSize) and the selected number of aggregated points. Default value is 1

Kind

Enumeration

Indicates the type of scheduled query rule. The default is LogAlert.

Value	Description
LogAlert
LogToMetric

ScheduledQueryRuleCriteria

Object

The rule criteria that defines the conditions of the scheduled query rule.

Name	Type	Description
allOf	Condition[]	A list of conditions to evaluate against the specified scopes

ScheduledQueryRuleResource

Object

The scheduled query rule resource.

Name	Type	Description
etag	string	The etag field is not required. If it is provided in the response body, it must also be provided as a header per the normal etag convention. Entity tags are used for comparing two or more entities from the same requested resource. HTTP/1.1 uses entity tags in the etag (section 14.19), If-Match (section 14.24), If-None-Match (section 14.26), and If-Range (section 14.27) header fields.
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
kind	Kind	Indicates the type of scheduled query rule. The default is LogAlert.
location	string	The geo-location where the resource lives
name	string	The name of the resource
properties.actions	Actions	Actions to invoke when the alert fires.
properties.autoMitigate	boolean	The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of the kind LogAlert.
properties.checkWorkspaceAlertsStorageConfigured	boolean	The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.
properties.createdWithApiVersion	string	The api-version used when creating this alert rule
properties.criteria	ScheduledQueryRuleCriteria	The rule criteria that defines the conditions of the scheduled query rule.
properties.description	string	The description of the scheduled query rule.
properties.displayName	string	The display name of the alert rule
properties.enabled	boolean	The flag which indicates whether this scheduled query rule is enabled. Value should be true or false
properties.evaluationFrequency	string (duration)	How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.
properties.isLegacyLogAnalyticsRule	boolean	True if alert rule is legacy Log Analytic rule
properties.isWorkspaceAlertsStorageConfigured	boolean	The flag which indicates whether this scheduled query rule has been configured to be stored in the customer's storage. The default is false.
properties.muteActionsDuration	string (duration)	Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.
properties.overrideQueryTimeRange	string (duration)	If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.
properties.scopes	string[]	The list of resource id's that this scheduled query rule is scoped to.
properties.severity	AlertSeverity (int64)	Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.
properties.skipQueryValidation	boolean	The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.
properties.targetResourceTypes	string[]	List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert
properties.windowSize	string (duration)	The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.
systemData	systemData	SystemData of ScheduledQueryRule.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

timeAggregation

Enumeration

Aggregation type. Relevant and required only for rules of the kind LogAlert.

Value	Description
Count
Average
Minimum
Maximum
Total

Share via

Scheduled Query Rules - Get

URI Parameters

Responses

Security

azure_auth

Scopes

Examples

Get a scheduled query rule for single resource

Sample request

Sample response

Definitions

Actions

AlertSeverity

Condition

conditionOperator

createdByType

Dimension

dimensionOperator

ErrorAdditionalInfo

ErrorContract

ErrorResponse

FailingPeriods

Kind

ScheduledQueryRuleCriteria

ScheduledQueryRuleResource

systemData

timeAggregation