Share via

Scheduled Query Rules - Create Or Update

Service:
Monitor
API Version:
2021-08-01

Creates or updates a scheduled query rule.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/scheduledQueryRules/{ruleName}?api-version=2021-08-01

URI Parameters

Name In Required Type Description
resourceGroupName
 path True

string

minLength: 1
maxLength: 90

The name of the resource group. The name is case insensitive.
ruleName
 path True

string

The name of the rule.
subscriptionId
 path True

string

minLength: 1

The ID of the target subscription.
api-version
 query True

string

minLength: 1

The API version to use for this operation.

Request Body

Name Required Type Description
location True

string

The geo-location where the resource lives
properties.criteria True

ScheduledQueryRuleCriteria

The rule criteria that defines the conditions of the scheduled query rule.
properties.enabled True

boolean

The flag which indicates whether this scheduled query rule is enabled. Value should be true or false
properties.scopes True

string[]

The list of resource id's that this scheduled query rule is scoped to.
kind

Kind

Indicates the type of scheduled query rule. The default is LogAlert.
properties.actions

Actions

Actions to invoke when the alert fires.
properties.autoMitigate

boolean

The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of the kind LogAlert.
properties.checkWorkspaceAlertsStorageConfigured

boolean

The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.
properties.description

string

The description of the scheduled query rule.
properties.displayName

string

The display name of the alert rule
properties.evaluationFrequency

string (duration)

How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.
properties.muteActionsDuration

string (duration)

Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.
properties.overrideQueryTimeRange

string (duration)

If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.
properties.severity

AlertSeverity (int64)

Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.
properties.skipQueryValidation

boolean

The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.
properties.targetResourceTypes

string[]

List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert
properties.windowSize

string (duration)

The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.
tags

object

Resource tags.

Responses

Name Type Description
200 OK

ScheduledQueryRuleResource

Successful request to update a scheduled query rule
201 Created

ScheduledQueryRuleResource

Created a scheduled query rule
Other Status Codes

ErrorContract

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

Create or update a scheduled query rule for Single Resource
Create or update a scheduled query rule on Resource group(s)
Create or update a scheduled query rule on Subscription

Create or update a scheduled query rule for Single Resource

Sample request

PUT https://management.azure.com/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourceGroups/QueryResourceGroupName/providers/Microsoft.Insights/scheduledQueryRules/perf?api-version=2021-08-01

{
  "location": "eastus",
  "properties": {
    "description": "Performance rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147/resourceGroups/scopeResourceGroup1/providers/Microsoft.Compute/virtualMachines/vm1"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\"",
          "timeAggregation": "Average",
          "metricMeasureColumn": "% Processor Time",
          "resourceIdColumn": "resourceId",
          "dimensions": [
            {
              "name": "ComputerIp",
              "operator": "Exclude",
              "values": [
                "192.168.1.1"
              ]
            },
            {
              "name": "OSType",
              "operator": "Include",
              "values": [
                "*"
              ]
            }
          ],
          "operator": "GreaterThan",
          "threshold": 70,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}

Sample response

Status code:
200 
{
  "id": "/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourcegroups/QueryResourceGroupName/providers/microsoft.insights/scheduledqueryrules/perf",
  "name": "perf",
  "type": "microsoft.insights/scheduledqueryrules",
  "location": "eastus",
  "tags": {},
  "properties": {
    "description": "Performance rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147/resourceGroups/scopeResourceGroup1/providers/Microsoft.Compute/virtualMachines/vm1"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\"",
          "timeAggregation": "Average",
          "metricMeasureColumn": "% Processor Time",
          "resourceIdColumn": "resourceId",
          "dimensions": [
            {
              "name": "ComputerIp",
              "operator": "Exclude",
              "values": [
                "192.168.1.1"
              ]
            },
            {
              "name": "OSType",
              "operator": "Include",
              "values": [
                "*"
              ]
            }
          ],
          "operator": "GreaterThan",
          "threshold": 70,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "isWorkspaceAlertsStorageConfigured": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}
Status code:
201 
{
  "id": "/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourcegroups/QueryResourceGroupName/providers/microsoft.insights/scheduledqueryrules/perf",
  "name": "perf",
  "type": "microsoft.insights/scheduledqueryrules",
  "location": "eastus",
  "tags": {},
  "properties": {
    "description": "Performance rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147/resourceGroups/scopeResourceGroup1/providers/Microsoft.Compute/virtualMachines/vm1"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\"",
          "timeAggregation": "Average",
          "metricMeasureColumn": "% Processor Time",
          "resourceIdColumn": "resourceId",
          "dimensions": [
            {
              "name": "ComputerIp",
              "operator": "Exclude",
              "values": [
                "192.168.1.1"
              ]
            },
            {
              "name": "OSType",
              "operator": "Include",
              "values": [
                "*"
              ]
            }
          ],
          "operator": "GreaterThan",
          "threshold": 70,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "isWorkspaceAlertsStorageConfigured": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}

Create or update a scheduled query rule on Resource group(s)

Sample request

PUT https://management.azure.com/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourceGroups/QueryResourceGroupName/providers/Microsoft.Insights/scheduledQueryRules/heartbeat?api-version=2021-08-01

{
  "location": "eastus",
  "properties": {
    "description": "Health check rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147/resourceGroups/scopeResourceGroup1"
    ],
    "targetResourceTypes": [
      "Microsoft.Compute/virtualMachines"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Heartbeat",
          "timeAggregation": "Count",
          "dimensions": [],
          "operator": "GreaterThan",
          "threshold": 360,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}

Sample response

Status code:
200 
{
  "id": "/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourcegroups/QueryResourceGroupName/providers/microsoft.insights/scheduledqueryrules/heartbeat",
  "name": "heartbeat",
  "type": "microsoft.insights/scheduledqueryrules",
  "location": "eastus",
  "tags": {},
  "properties": {
    "description": "Health check rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147/resourceGroups/scopeResourceGroup1"
    ],
    "targetResourceTypes": [
      "Microsoft.Compute/virtualMachines"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Heartbeat",
          "timeAggregation": "Count",
          "dimensions": [],
          "operator": "GreaterThan",
          "threshold": 360,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "isWorkspaceAlertsStorageConfigured": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}
Status code:
201 
{
  "id": "/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourcegroups/QueryResourceGroupName/providers/microsoft.insights/scheduledqueryrules/heartbeat",
  "name": "heartbeat",
  "type": "microsoft.insights/scheduledqueryrules",
  "location": "eastus",
  "tags": {},
  "properties": {
    "description": "Health check rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147/resourceGroups/scopeResourceGroup1"
    ],
    "targetResourceTypes": [
      "Microsoft.Compute/virtualMachines"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Heartbeat",
          "timeAggregation": "Count",
          "dimensions": [],
          "operator": "GreaterThan",
          "threshold": 360,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "isWorkspaceAlertsStorageConfigured": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}

Create or update a scheduled query rule on Subscription

Sample request

PUT https://management.azure.com/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourceGroups/QueryResourceGroupName/providers/Microsoft.Insights/scheduledQueryRules/perf?api-version=2021-08-01

{
  "location": "eastus",
  "properties": {
    "description": "Performance rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147"
    ],
    "targetResourceTypes": [
      "Microsoft.Compute/virtualMachines"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\"",
          "timeAggregation": "Average",
          "metricMeasureColumn": "% Processor Time",
          "resourceIdColumn": "resourceId",
          "dimensions": [
            {
              "name": "ComputerIp",
              "operator": "Exclude",
              "values": [
                "192.168.1.1"
              ]
            },
            {
              "name": "OSType",
              "operator": "Include",
              "values": [
                "*"
              ]
            }
          ],
          "operator": "GreaterThan",
          "threshold": 70,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}

Sample response

Status code:
200 
{
  "id": "/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourcegroups/QueryResourceGroupName/providers/microsoft.insights/scheduledqueryrules/perf",
  "name": "perf",
  "type": "microsoft.insights/scheduledqueryrules",
  "location": "eastus",
  "tags": {},
  "properties": {
    "description": "Performance rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147"
    ],
    "targetResourceTypes": [
      "Microsoft.Compute/virtualMachines"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\"",
          "timeAggregation": "Average",
          "metricMeasureColumn": "% Processor Time",
          "resourceIdColumn": "resourceId",
          "dimensions": [
            {
              "name": "ComputerIp",
              "operator": "Exclude",
              "values": [
                "192.168.1.1"
              ]
            },
            {
              "name": "OSType",
              "operator": "Include",
              "values": [
                "*"
              ]
            }
          ],
          "operator": "GreaterThan",
          "threshold": 70,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "isWorkspaceAlertsStorageConfigured": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}
Status code:
201 
{
  "id": "/subscriptions/dd4bfc94-a096-412b-9c43-4bd13e35afbc/resourcegroups/QueryResourceGroupName/providers/microsoft.insights/scheduledqueryrules/perf",
  "name": "perf",
  "type": "microsoft.insights/scheduledqueryrules",
  "location": "eastus",
  "tags": {},
  "properties": {
    "description": "Performance rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/aaf177ed-1330-a9f2-80ea-fd3d7783b147"
    ],
    "targetResourceTypes": [
      "Microsoft.Compute/virtualMachines"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\"",
          "timeAggregation": "Average",
          "metricMeasureColumn": "% Processor Time",
          "resourceIdColumn": "resourceId",
          "dimensions": [
            {
              "name": "ComputerIp",
              "operator": "Exclude",
              "values": [
                "192.168.1.1"
              ]
            },
            {
              "name": "OSType",
              "operator": "Include",
              "values": [
                "*"
              ]
            }
          ],
          "operator": "GreaterThan",
          "threshold": 70,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "PT30M",
    "actions": {
      "actionGroups": [
        "/subscriptions/1cf177ed-1330-4692-80ea-fd3d7783b147/resourcegroups/sqrapi/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      }
    },
    "autoMitigate": true,
    "isWorkspaceAlertsStorageConfigured": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}

Definitions

Name Description
Actions

Actions to invoke when the alert fires.
AlertSeverity

Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.
Condition

A condition of the scheduled query rule.
conditionOperator

The criteria operator. Relevant and required only for rules of the kind LogAlert.
createdByType

The type of identity that created the resource.
Dimension

Dimension splitting and filtering definition
dimensionOperator

Operator for dimension values
ErrorAdditionalInfo

The resource management error additional info.
ErrorContract

Describes the format of Error response.
ErrorResponse

Error Response
FailingPeriods

The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.
Kind

Indicates the type of scheduled query rule. The default is LogAlert.
ScheduledQueryRuleCriteria

The rule criteria that defines the conditions of the scheduled query rule.
ScheduledQueryRuleResource

The scheduled query rule resource.
systemData

Metadata pertaining to creation and last modification of the resource.
timeAggregation

Aggregation type. Relevant and required only for rules of the kind LogAlert.

Actions

Object

Actions to invoke when the alert fires.

Name Type Description
actionGroups

string[]

Action Group resource Ids to invoke when the alert fires.
customProperties

object

The properties of an alert payload.

AlertSeverity

Enumeration

Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.

Value Description
0
1
2
3
4

Condition

Object

A condition of the scheduled query rule.

Name Type Description
dimensions

Dimension[]

List of Dimensions conditions
failingPeriods

FailingPeriods

The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.
metricMeasureColumn

string

The column containing the metric measure number. Relevant only for rules of the kind LogAlert.
metricName

string

The name of the metric to be sent. Relevant and required only for rules of the kind LogToMetric.
operator

conditionOperator

The criteria operator. Relevant and required only for rules of the kind LogAlert.
query

string

Log query alert
resourceIdColumn

string

The column containing the resource id. The content of the column must be a uri formatted as resource id. Relevant only for rules of the kind LogAlert.
threshold

number (double)

the criteria threshold value that activates the alert. Relevant and required only for rules of the kind LogAlert.
timeAggregation

timeAggregation

Aggregation type. Relevant and required only for rules of the kind LogAlert.

conditionOperator

Enumeration

The criteria operator. Relevant and required only for rules of the kind LogAlert.

Value Description
Equals
GreaterThan
GreaterThanOrEqual
LessThan
LessThanOrEqual

createdByType

Enumeration

The type of identity that created the resource.

Value Description
User
Application
ManagedIdentity
Key

Dimension

Object

Dimension splitting and filtering definition

Name Type Description
name

string

Name of the dimension
operator

dimensionOperator

Operator for dimension values
values

string[]

List of dimension values

dimensionOperator

Enumeration

Operator for dimension values

Value Description
Include
Exclude

ErrorAdditionalInfo

Object

The resource management error additional info.

Name Type Description
info

object

The additional info.
type

string

The additional info type.

ErrorContract

Object

Describes the format of Error response.

Name Type Description
error

ErrorResponse

Error Response
The error details.

ErrorResponse

Object

Error Response

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.
code

string

The error code.
details

ErrorResponse[]

The error details.
message

string

The error message.
target

string

The error target.

FailingPeriods

Object

The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.

Name Type Default value Description
minFailingPeriodsToAlert

integer (int64)

1

The number of violations to trigger an alert. Should be smaller or equal to numberOfEvaluationPeriods. Default value is 1
numberOfEvaluationPeriods

integer (int64)

1

The number of aggregated lookback points. The lookback time window is calculated based on the aggregation granularity (windowSize) and the selected number of aggregated points. Default value is 1

Kind

Enumeration

Indicates the type of scheduled query rule. The default is LogAlert.

Value Description
LogAlert
LogToMetric

ScheduledQueryRuleCriteria

Object

The rule criteria that defines the conditions of the scheduled query rule.

Name Type Description
allOf

Condition[]

A list of conditions to evaluate against the specified scopes

ScheduledQueryRuleResource

Object

The scheduled query rule resource.

Name Type Description
etag

string

The etag field is not required. If it is provided in the response body, it must also be provided as a header per the normal etag convention. Entity tags are used for comparing two or more entities from the same requested resource. HTTP/1.1 uses entity tags in the etag (section 14.19), If-Match (section 14.24), If-None-Match (section 14.26), and If-Range (section 14.27) header fields.
id

string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
kind

Kind

Indicates the type of scheduled query rule. The default is LogAlert.
location

string

The geo-location where the resource lives
name

string

The name of the resource
properties.actions

Actions

Actions to invoke when the alert fires.
properties.autoMitigate

boolean

The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of the kind LogAlert.
properties.checkWorkspaceAlertsStorageConfigured

boolean

The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.
properties.createdWithApiVersion

string

The api-version used when creating this alert rule
properties.criteria

ScheduledQueryRuleCriteria

The rule criteria that defines the conditions of the scheduled query rule.
properties.description

string

The description of the scheduled query rule.
properties.displayName

string

The display name of the alert rule
properties.enabled

boolean

The flag which indicates whether this scheduled query rule is enabled. Value should be true or false
properties.evaluationFrequency

string (duration)

How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.
properties.isLegacyLogAnalyticsRule

boolean

True if alert rule is legacy Log Analytic rule
properties.isWorkspaceAlertsStorageConfigured

boolean

The flag which indicates whether this scheduled query rule has been configured to be stored in the customer's storage. The default is false.
properties.muteActionsDuration

string (duration)

Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.
properties.overrideQueryTimeRange

string (duration)

If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.
properties.scopes

string[]

The list of resource id's that this scheduled query rule is scoped to.
properties.severity

AlertSeverity (int64)

Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.
properties.skipQueryValidation

boolean

The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.
properties.targetResourceTypes

string[]

List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert
properties.windowSize

string (duration)

The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.
systemData

systemData

SystemData of ScheduledQueryRule.
tags

object

Resource tags.
type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string (date-time)

The timestamp of resource creation (UTC).
createdBy

string

The identity that created the resource.
createdByType

createdByType

The type of identity that created the resource.
lastModifiedAt

string (date-time)

The timestamp of resource last modification (UTC)
lastModifiedBy

string

The identity that last modified the resource.
lastModifiedByType

createdByType

The type of identity that last modified the resource.

timeAggregation

Enumeration

Aggregation type. Relevant and required only for rules of the kind LogAlert.

Value Description
Count
Average
Minimum
Maximum
Total