I try to create scheduled alert rule in terraform. This is my code:
<code>resource "azurerm_monitor_scheduled_query_rules_alert_v2" "failed_alert" {
lifecycle {
ignore_changes = [
tags
]
}
name = "test"
resource_group_name = var.rg_name
description = "desc"
scopes = [var.app_insights_id]
location = var.location
evaluation_frequency = "PT5M"
window_duration = "PT5M"
severity = 0
auto_mitigation_enabled = false
enabled = true
criteria {
query = <<-QUERY
requests
| where success == 'False'
| project timestamp,
name,
success,
itemType,
duration,
operation_Name
QUERY
operator = "GreaterThanOrEqual"
threshold = 1
time_aggregation_method = "Count"
failing_periods {
minimum_failing_periods_to_trigger_alert = 1
number_of_evaluation_periods = 1
}
}
action {
action_groups = [var.action_group_id]
}
}
</code>
<code>resource "azurerm_monitor_scheduled_query_rules_alert_v2" "failed_alert" {
lifecycle {
ignore_changes = [
tags
]
}
name = "test"
resource_group_name = var.rg_name
description = "desc"
scopes = [var.app_insights_id]
location = var.location
evaluation_frequency = "PT5M"
window_duration = "PT5M"
severity = 0
auto_mitigation_enabled = false
enabled = true
criteria {
query = <<-QUERY
requests
| where success == 'False'
| project timestamp,
name,
success,
itemType,
duration,
operation_Name
QUERY
operator = "GreaterThanOrEqual"
threshold = 1
time_aggregation_method = "Count"
failing_periods {
minimum_failing_periods_to_trigger_alert = 1
number_of_evaluation_periods = 1
}
}
action {
action_groups = [var.action_group_id]
}
}
</code>
resource "azurerm_monitor_scheduled_query_rules_alert_v2" "failed_alert" {
lifecycle {
ignore_changes = [
tags
]
}
name = "test"
resource_group_name = var.rg_name
description = "desc"
scopes = [var.app_insights_id]
location = var.location
evaluation_frequency = "PT5M"
window_duration = "PT5M"
severity = 0
auto_mitigation_enabled = false
enabled = true
criteria {
query = <<-QUERY
requests
| where success == 'False'
| project timestamp,
name,
success,
itemType,
duration,
operation_Name
QUERY
operator = "GreaterThanOrEqual"
threshold = 1
time_aggregation_method = "Count"
failing_periods {
minimum_failing_periods_to_trigger_alert = 1
number_of_evaluation_periods = 1
}
}
action {
action_groups = [var.action_group_id]
}
}
The problem is, that this alert is never triggered.
When i want to change something in that alert, my screen is blank:
But when i try to edit alert rule created via portal, it works:
When I was investigating i realized, that exported template looks a little bit different from alert rule created by hand and created via Terraform. With one created via terraform the difference is property kind
which is set to LogAlert
:
<code>{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "microsoft.insights/scheduledqueryrules",
"apiVersion": "2023-03-15-preview",
"name": "alert",
"location": "westeurope",
"tags": {
},
"kind": "LogAlert",
"identity": {
"type": "None"
},
"properties": {
"description": "Gives an alert for specified workflows that failed.",
"severity": 0,
"enabled": true,
"evaluationFrequency": "PT5M",
"scopes": [
"/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Insights/components/{component-name}"
],
"windowSize": "PT5M",
"criteria": {
"allOf": [
{
"query": "requests | where success == 'False' | project timestamp, name, success, itemType, duration, operation_Name, LogicappName = cloud_RoleName",
"timeAggregation": "Count",
"operator": "GreaterThanOrEqual",
"threshold": 1,
"failingPeriods": {
"numberOfEvaluationPeriods": 1,
"minFailingPeriodsToAlert": 1
}
}
]
},
"autoMitigate": false,
"actions": {
"actionGroups": [
"/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Insights/actionGroups/{action-group-name}"
],
"customProperties": {}
},
"checkWorkspaceAlertsStorageConfigured": false,
"skipQueryValidation": false
}
}
]
}
</code>
<code>{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "microsoft.insights/scheduledqueryrules",
"apiVersion": "2023-03-15-preview",
"name": "alert",
"location": "westeurope",
"tags": {
},
"kind": "LogAlert",
"identity": {
"type": "None"
},
"properties": {
"description": "Gives an alert for specified workflows that failed.",
"severity": 0,
"enabled": true,
"evaluationFrequency": "PT5M",
"scopes": [
"/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Insights/components/{component-name}"
],
"windowSize": "PT5M",
"criteria": {
"allOf": [
{
"query": "requests | where success == 'False' | project timestamp, name, success, itemType, duration, operation_Name, LogicappName = cloud_RoleName",
"timeAggregation": "Count",
"operator": "GreaterThanOrEqual",
"threshold": 1,
"failingPeriods": {
"numberOfEvaluationPeriods": 1,
"minFailingPeriodsToAlert": 1
}
}
]
},
"autoMitigate": false,
"actions": {
"actionGroups": [
"/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Insights/actionGroups/{action-group-name}"
],
"customProperties": {}
},
"checkWorkspaceAlertsStorageConfigured": false,
"skipQueryValidation": false
}
}
]
}
</code>
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"type": "microsoft.insights/scheduledqueryrules",
"apiVersion": "2023-03-15-preview",
"name": "alert",
"location": "westeurope",
"tags": {
},
"kind": "LogAlert",
"identity": {
"type": "None"
},
"properties": {
"description": "Gives an alert for specified workflows that failed.",
"severity": 0,
"enabled": true,
"evaluationFrequency": "PT5M",
"scopes": [
"/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Insights/components/{component-name}"
],
"windowSize": "PT5M",
"criteria": {
"allOf": [
{
"query": "requests | where success == 'False' | project timestamp, name, success, itemType, duration, operation_Name, LogicappName = cloud_RoleName",
"timeAggregation": "Count",
"operator": "GreaterThanOrEqual",
"threshold": 1,
"failingPeriods": {
"numberOfEvaluationPeriods": 1,
"minFailingPeriodsToAlert": 1
}
}
]
},
"autoMitigate": false,
"actions": {
"actionGroups": [
"/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Insights/actionGroups/{action-group-name}"
],
"customProperties": {}
},
"checkWorkspaceAlertsStorageConfigured": false,
"skipQueryValidation": false
}
}
]
}
Why my alert provisioned via terraform doesnt work?