I would like to deploy Application Insights Alerts based on Custom Log Search with suppressing alerts set via ARM Template. There is a property "throttlingInMin": 30,
but it doesn't seem to do anything.
This is the template:
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",
"contentVersion": "1.0.0.0",
"parameters": {
"existingApplicationInsightsName": {
"type": "string"
}
},
"variables": {},
"resources": [
{
"apiVersion": "2018-04-16",
"type": "Microsoft.Insights/scheduledQueryRules",
"name": "Alert1",
"location": "[resourceGroup().location]",
"tags": {
"[concat('hidden-link:', resourceId('microsoft.insights/components', parameters('existingApplicationInsightsName')))]": "Resource"
},
"properties": {
"description": "Description1",
"Enabled": "True",
"source": {
"query": "customMetrics | summarize AggregatedValue = count() by bin(timestamp, 15m),client_StateOrProvince",
"dataSourceId": "[resourceId('microsoft.insights/components', parameters('existingApplicationInsightsName'))]",
"queryType": "ResultCount"
},
"schedule": {
"FrequencyInMinutes": 40,
"TimeWindowInMinutes": 40
},
"action": {
"odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction",
"Severity": "3",
"aznsAction": {
"actionGroup": [
"/subscriptions/131c713e-23e2-4eec-b592-61e975f28e6b/resourceGroups/Alerts/providers/microsoft.insights/actiongroups/Me"
],
"throttlingInMin": 30,
"emailSubject": null,
"customWebhookPayload": null
},
"trigger": {
"ThresholdOperator": "GreaterThan",
"Threshold": 0
}
}
}
}
]
}
After it is deployed successfully. Suppress Alerts checkbox is still unchecked:
Set the throttleConsecutiveWindowCount
to 0
, next to your throttlingInMin
property, like below
"throttlingInMin": 30,
"throttleConsecutiveWindowCount": 0,
And move them under the action
property, like below:
"action": {
"odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction",
"Severity": "3",
"aznsAction": {
"actionGroup": [
"/subscriptions/131c713e-23e2-4eec-b592-61e975f28e6b/resourceGroups/Alerts/providers/microsoft.insights/actiongroups/Me"
],
"emailSubject": null,
"customWebhookPayload": null
},
"throttlingInMin": 30,
"throttleConsecutiveWindowCount": 0,
"trigger": {
"ThresholdOperator": "GreaterThan",
"Threshold": 0
}
}