Create a log alert from Azure CLI

Question

I need to create an alert from Azure CLI (no access to portal), using a "custom log search" signal on containerLogV2 to see if there are any exceptions in any of my containers. I have an action group which I need to use for sending emails and sms. I have the below command and am quite sure that I am not setting the condition right. Please advise what the right approach would be. I couldn't find any example for this case on MSDN docs. Thanks.

az monitor metrics alert create \
--condition  "ContainerLogV2 | where LogMessage has "Exception" | where ContainerName !has "sms-management" | where TimeGenerated > ago(1h)" \
--name "Dev AKS Errors Alert" \
--resource-group "my-rg" \
--scopes "/subscriptions/my-sub/resourcegroups/my-rg/" \
--evaluation-frequency "60m" \
--severity 1 \
--region "west europe" \
--action "/subscriptions/my-sub/resourcegroups/my-rg/providers/microsoft.insights/actiongroups/my-ag" 

I probably need to figure out what details I need to send in the email and the sms from my alert next. Any help on that would be appreciated as well. Thank you.

[Update] Based on the advice from @Jahnavi I tried the below command

az monitor scheduled-query create \
--resource-group "my-rg" \
--name "AKS Errors Alert" \
--scopes "/subscriptions/supscription-id/resourcegroups/my-rg/providers/Microsoft.ContainerService/managedClusters/aks-dev" \
--condition "count 'AppExceptions' > 1 resource id _ResourceId at least 1 violations out of 5 aggregated points" \
--condition-query AppExceptions="ContainerLogV2 | where LogMessage has \"Exception\" | where TimeGenerated > ago(1h)" \
--description "Notify team on exceptions in AKS" \
--location "westeurope" \
--evaluation-frequency "5m" \
--severity 1 \
--action-groups "/subscriptions/supscription-id/resourceGroups/my-rg/providers/microsoft.insights/actionGroups/my-ag"

I was able to create a new alert rule with the above command.

Answer 1

az monitor metrics alert create is mostly used to create the inbuilt metrics, not conditional queries or custom log search queries.

You need to execute the az monitor scheduled-query create command to create an alert using a "custom log search" signal on any application using Az CLI.

I've modified your script as below:

rg="ResourceGroup"
workspace="ws"

query='ContainerLogV2 
| where ContainerName !has \"sms-management\" 
| where LogMessage has \"Exception\" 
| where TimeGenerated > ago(1h)'

WID=$(az monitor log-analytics workspace show --resource-group $rg --workspace-name $workspace --query id --out tsv)

az monitor scheduled-query create \
    --name "TestQuery" \
    --resource-group $rg \
    --scopes $workspace \
    --description "Test" \
    --action $ActionID \
    --evaluation-frequency 5m \
    --severity 1 \
    --condition "" \ #Provide the required condition
    --condition-query $query

As per the MSDoc, I've taken the sample conditional query and it worked as below:

Output: