azure.monitoring.ScheduledQueryRulesAlert

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
import * as std from "@pulumi/std";

const example = new azure.core.ResourceGroup("example", {
    name: "monitoring-resources",
    location: "West Europe",
});
const exampleInsights = new azure.appinsights.Insights("example", {
    name: "appinsights",
    location: example.location,
    resourceGroupName: example.name,
    applicationType: "web",
});
const example2 = new azure.appinsights.Insights("example2", {
    name: "appinsights2",
    location: example.location,
    resourceGroupName: example.name,
    applicationType: "web",
});
// Example: Alerting Action with result count trigger
const exampleScheduledQueryRulesAlert = new azure.monitoring.ScheduledQueryRulesAlert("example", {
    name: "example",
    location: example.location,
    resourceGroupName: example.name,
    action: {
        actionGroups: [],
        emailSubject: "Email Header",
        customWebhookPayload: "{}",
    },
    dataSourceId: exampleInsights.id,
    description: "Alert when total results cross threshold",
    enabled: true,
    query: `requests
  | where tolong(resultCode) >= 500
  | summarize count() by bin(timestamp, 5m)
`,
    severity: 1,
    frequency: 5,
    timeWindow: 30,
    trigger: {
        operator: "GreaterThan",
        threshold: 3,
    },
    tags: {
        foo: "bar",
    },
});
// Example: Alerting Action Cross-Resource
const example2ScheduledQueryRulesAlert = new azure.monitoring.ScheduledQueryRulesAlert("example2", {
    name: "example",
    location: example.location,
    resourceGroupName: example.name,
    authorizedResourceIds: [example2.id],
    action: {
        actionGroups: [],
        emailSubject: "Email Header",
        customWebhookPayload: "{}",
    },
    dataSourceId: exampleInsights.id,
    description: "Query may access data within multiple resources",
    enabled: true,
    query: std.format({
        input: `let a=requests
  | where toint(resultCode) >= 500
  | extend fail=1; let b=app('%s').requests
  | where toint(resultCode) >= 500 | extend fail=1; a
  | join b on fail
`,
        args: [example2.id],
    }).then(invoke => invoke.result),
    severity: 1,
    frequency: 5,
    timeWindow: 30,
    trigger: {
        operator: "GreaterThan",
        threshold: 3,
    },
    tags: {
        foo: "bar",
    },
});

import pulumi
import pulumi_azure as azure
import pulumi_std as std

example = azure.core.ResourceGroup("example",
    name="monitoring-resources",
    location="West Europe")
example_insights = azure.appinsights.Insights("example",
    name="appinsights",
    location=example.location,
    resource_group_name=example.name,
    application_type="web")
example2 = azure.appinsights.Insights("example2",
    name="appinsights2",
    location=example.location,
    resource_group_name=example.name,
    application_type="web")
# Example: Alerting Action with result count trigger
example_scheduled_query_rules_alert = azure.monitoring.ScheduledQueryRulesAlert("example",
    name="example",
    location=example.location,
    resource_group_name=example.name,
    action={
        "action_groups": [],
        "email_subject": "Email Header",
        "custom_webhook_payload": "{}",
    },
    data_source_id=example_insights.id,
    description="Alert when total results cross threshold",
    enabled=True,
    query="""requests
  | where tolong(resultCode) >= 500
  | summarize count() by bin(timestamp, 5m)
""",
    severity=1,
    frequency=5,
    time_window=30,
    trigger={
        "operator": "GreaterThan",
        "threshold": 3,
    },
    tags={
        "foo": "bar",
    })
# Example: Alerting Action Cross-Resource
example2_scheduled_query_rules_alert = azure.monitoring.ScheduledQueryRulesAlert("example2",
    name="example",
    location=example.location,
    resource_group_name=example.name,
    authorized_resource_ids=[example2.id],
    action={
        "action_groups": [],
        "email_subject": "Email Header",
        "custom_webhook_payload": "{}",
    },
    data_source_id=example_insights.id,
    description="Query may access data within multiple resources",
    enabled=True,
    query=std.format(input="""let a=requests
  | where toint(resultCode) >= 500
  | extend fail=1; let b=app('%s').requests
  | where toint(resultCode) >= 500 | extend fail=1; a
  | join b on fail
""",
        args=[example2.id]).result,
    severity=1,
    frequency=5,
    time_window=30,
    trigger={
        "operator": "GreaterThan",
        "threshold": 3,
    },
    tags={
        "foo": "bar",
    })

package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/appinsights"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/monitoring"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
			Name:     pulumi.String("monitoring-resources"),
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleInsights, err := appinsights.NewInsights(ctx, "example", &appinsights.InsightsArgs{
			Name:              pulumi.String("appinsights"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			ApplicationType:   pulumi.String("web"),
		})
		if err != nil {
			return err
		}
		example2, err := appinsights.NewInsights(ctx, "example2", &appinsights.InsightsArgs{
			Name:              pulumi.String("appinsights2"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			ApplicationType:   pulumi.String("web"),
		})
		if err != nil {
			return err
		}
		// Example: Alerting Action with result count trigger
		_, err = monitoring.NewScheduledQueryRulesAlert(ctx, "example", &monitoring.ScheduledQueryRulesAlertArgs{
			Name:              pulumi.String("example"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			Action: &monitoring.ScheduledQueryRulesAlertActionArgs{
				ActionGroups:         pulumi.StringArray{},
				EmailSubject:         pulumi.String("Email Header"),
				CustomWebhookPayload: pulumi.String("{}"),
			},
			DataSourceId: exampleInsights.ID(),
			Description:  pulumi.String("Alert when total results cross threshold"),
			Enabled:      pulumi.Bool(true),
			Query:        pulumi.String("requests\n  | where tolong(resultCode) >= 500\n  | summarize count() by bin(timestamp, 5m)\n"),
			Severity:     pulumi.Int(1),
			Frequency:    pulumi.Int(5),
			TimeWindow:   pulumi.Int(30),
			Trigger: &monitoring.ScheduledQueryRulesAlertTriggerArgs{
				Operator:  pulumi.String("GreaterThan"),
				Threshold: pulumi.Float64(3),
			},
			Tags: pulumi.StringMap{
				"foo": pulumi.String("bar"),
			},
		})
		if err != nil {
			return err
		}
		invokeFormat, err := std.Format(ctx, &std.FormatArgs{
			Input: `let a=requests
  | where toint(resultCode) >= 500
  | extend fail=1; let b=app('%s').requests
  | where toint(resultCode) >= 500 | extend fail=1; a
  | join b on fail
`,
			Args: pulumi.StringArray{
				example2.ID(),
			},
		}, nil)
		if err != nil {
			return err
		}
		// Example: Alerting Action Cross-Resource
		_, err = monitoring.NewScheduledQueryRulesAlert(ctx, "example2", &monitoring.ScheduledQueryRulesAlertArgs{
			Name:              pulumi.String("example"),
			Location:          example.Location,
			ResourceGroupName: example.Name,
			AuthorizedResourceIds: pulumi.StringArray{
				example2.ID(),
			},
			Action: &monitoring.ScheduledQueryRulesAlertActionArgs{
				ActionGroups:         pulumi.StringArray{},
				EmailSubject:         pulumi.String("Email Header"),
				CustomWebhookPayload: pulumi.String("{}"),
			},
			DataSourceId: exampleInsights.ID(),
			Description:  pulumi.String("Query may access data within multiple resources"),
			Enabled:      pulumi.Bool(true),
			Query:        pulumi.String(invokeFormat.Result),
			Severity:     pulumi.Int(1),
			Frequency:    pulumi.Int(5),
			TimeWindow:   pulumi.Int(30),
			Trigger: &monitoring.ScheduledQueryRulesAlertTriggerArgs{
				Operator:  pulumi.String("GreaterThan"),
				Threshold: pulumi.Float64(3),
			},
			Tags: pulumi.StringMap{
				"foo": pulumi.String("bar"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() => 
{
    var example = new Azure.Core.ResourceGroup("example", new()
    {
        Name = "monitoring-resources",
        Location = "West Europe",
    });

    var exampleInsights = new Azure.AppInsights.Insights("example", new()
    {
        Name = "appinsights",
        Location = example.Location,
        ResourceGroupName = example.Name,
        ApplicationType = "web",
    });

    var example2 = new Azure.AppInsights.Insights("example2", new()
    {
        Name = "appinsights2",
        Location = example.Location,
        ResourceGroupName = example.Name,
        ApplicationType = "web",
    });

    // Example: Alerting Action with result count trigger
    var exampleScheduledQueryRulesAlert = new Azure.Monitoring.ScheduledQueryRulesAlert("example", new()
    {
        Name = "example",
        Location = example.Location,
        ResourceGroupName = example.Name,
        Action = new Azure.Monitoring.Inputs.ScheduledQueryRulesAlertActionArgs
        {
            ActionGroups = new() { },
            EmailSubject = "Email Header",
            CustomWebhookPayload = "{}",
        },
        DataSourceId = exampleInsights.Id,
        Description = "Alert when total results cross threshold",
        Enabled = true,
        Query = @"requests
  | where tolong(resultCode) >= 500
  | summarize count() by bin(timestamp, 5m)
",
        Severity = 1,
        Frequency = 5,
        TimeWindow = 30,
        Trigger = new Azure.Monitoring.Inputs.ScheduledQueryRulesAlertTriggerArgs
        {
            Operator = "GreaterThan",
            Threshold = 3,
        },
        Tags = 
        {
            { "foo", "bar" },
        },
    });

    // Example: Alerting Action Cross-Resource
    var example2ScheduledQueryRulesAlert = new Azure.Monitoring.ScheduledQueryRulesAlert("example2", new()
    {
        Name = "example",
        Location = example.Location,
        ResourceGroupName = example.Name,
        AuthorizedResourceIds = new[]
        {
            example2.Id,
        },
        Action = new Azure.Monitoring.Inputs.ScheduledQueryRulesAlertActionArgs
        {
            ActionGroups = new() { },
            EmailSubject = "Email Header",
            CustomWebhookPayload = "{}",
        },
        DataSourceId = exampleInsights.Id,
        Description = "Query may access data within multiple resources",
        Enabled = true,
        Query = Std.Format.Invoke(new()
        {
            Input = @"let a=requests
  | where toint(resultCode) >= 500
  | extend fail=1; let b=app('%s').requests
  | where toint(resultCode) >= 500 | extend fail=1; a
  | join b on fail
",
            Args = new[]
            {
                example2.Id,
            },
        }).Apply(invoke => invoke.Result),
        Severity = 1,
        Frequency = 5,
        TimeWindow = 30,
        Trigger = new Azure.Monitoring.Inputs.ScheduledQueryRulesAlertTriggerArgs
        {
            Operator = "GreaterThan",
            Threshold = 3,
        },
        Tags = 
        {
            { "foo", "bar" },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.appinsights.Insights;
import com.pulumi.azure.appinsights.InsightsArgs;
import com.pulumi.azure.monitoring.ScheduledQueryRulesAlert;
import com.pulumi.azure.monitoring.ScheduledQueryRulesAlertArgs;
import com.pulumi.azure.monitoring.inputs.ScheduledQueryRulesAlertActionArgs;
import com.pulumi.azure.monitoring.inputs.ScheduledQueryRulesAlertTriggerArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.FormatArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new ResourceGroup("example", ResourceGroupArgs.builder()
            .name("monitoring-resources")
            .location("West Europe")
            .build());

        var exampleInsights = new Insights("exampleInsights", InsightsArgs.builder()
            .name("appinsights")
            .location(example.location())
            .resourceGroupName(example.name())
            .applicationType("web")
            .build());

        var example2 = new Insights("example2", InsightsArgs.builder()
            .name("appinsights2")
            .location(example.location())
            .resourceGroupName(example.name())
            .applicationType("web")
            .build());

        // Example: Alerting Action with result count trigger
        var exampleScheduledQueryRulesAlert = new ScheduledQueryRulesAlert("exampleScheduledQueryRulesAlert", ScheduledQueryRulesAlertArgs.builder()
            .name("example")
            .location(example.location())
            .resourceGroupName(example.name())
            .action(ScheduledQueryRulesAlertActionArgs.builder()
                .actionGroups()
                .emailSubject("Email Header")
                .customWebhookPayload("{}")
                .build())
            .dataSourceId(exampleInsights.id())
            .description("Alert when total results cross threshold")
            .enabled(true)
            .query("""
requests
  | where tolong(resultCode) >= 500
  | summarize count() by bin(timestamp, 5m)
            """)
            .severity(1)
            .frequency(5)
            .timeWindow(30)
            .trigger(ScheduledQueryRulesAlertTriggerArgs.builder()
                .operator("GreaterThan")
                .threshold(3.0)
                .build())
            .tags(Map.of("foo", "bar"))
            .build());

        // Example: Alerting Action Cross-Resource
        var example2ScheduledQueryRulesAlert = new ScheduledQueryRulesAlert("example2ScheduledQueryRulesAlert", ScheduledQueryRulesAlertArgs.builder()
            .name("example")
            .location(example.location())
            .resourceGroupName(example.name())
            .authorizedResourceIds(example2.id())
            .action(ScheduledQueryRulesAlertActionArgs.builder()
                .actionGroups()
                .emailSubject("Email Header")
                .customWebhookPayload("{}")
                .build())
            .dataSourceId(exampleInsights.id())
            .description("Query may access data within multiple resources")
            .enabled(true)
            .query(StdFunctions.format(FormatArgs.builder()
                .input("""
let a=requests
  | where toint(resultCode) >= 500
  | extend fail=1; let b=app('%s').requests
  | where toint(resultCode) >= 500 | extend fail=1; a
  | join b on fail
                """)
                .args(example2.id())
                .build()).result())
            .severity(1)
            .frequency(5)
            .timeWindow(30)
            .trigger(ScheduledQueryRulesAlertTriggerArgs.builder()
                .operator("GreaterThan")
                .threshold(3.0)
                .build())
            .tags(Map.of("foo", "bar"))
            .build());

    }
}

resources:
  example:
    type: azure:core:ResourceGroup
    properties:
      name: monitoring-resources
      location: West Europe
  exampleInsights:
    type: azure:appinsights:Insights
    name: example
    properties:
      name: appinsights
      location: ${example.location}
      resourceGroupName: ${example.name}
      applicationType: web
  example2:
    type: azure:appinsights:Insights
    properties:
      name: appinsights2
      location: ${example.location}
      resourceGroupName: ${example.name}
      applicationType: web
  # Example: Alerting Action with result count trigger
  exampleScheduledQueryRulesAlert:
    type: azure:monitoring:ScheduledQueryRulesAlert
    name: example
    properties:
      name: example
      location: ${example.location}
      resourceGroupName: ${example.name}
      action:
        actionGroups: []
        emailSubject: Email Header
        customWebhookPayload: '{}'
      dataSourceId: ${exampleInsights.id}
      description: Alert when total results cross threshold
      enabled: true # Count all requests with server error result code grouped into 5-minute bins
      query: |
        requests
          | where tolong(resultCode) >= 500
          | summarize count() by bin(timestamp, 5m)        
      severity: 1
      frequency: 5
      timeWindow: 30
      trigger:
        operator: GreaterThan
        threshold: 3
      tags:
        foo: bar
  # Example: Alerting Action Cross-Resource
  example2ScheduledQueryRulesAlert:
    type: azure:monitoring:ScheduledQueryRulesAlert
    name: example2
    properties:
      name: example
      location: ${example.location}
      resourceGroupName: ${example.name}
      authorizedResourceIds:
        - ${example2.id}
      action:
        actionGroups: []
        emailSubject: Email Header
        customWebhookPayload: '{}'
      dataSourceId: ${exampleInsights.id}
      description: Query may access data within multiple resources
      enabled: true # Count requests in multiple log resources and group into 5-minute bins by HTTP operation
      query:
        fn::invoke:
          function: std:format
          arguments:
            input: |
              let a=requests
                | where toint(resultCode) >= 500
                | extend fail=1; let b=app('%s').requests
                | where toint(resultCode) >= 500 | extend fail=1; a
                | join b on fail              
            args:
              - ${example2.id}
          return: result
      severity: 1
      frequency: 5
      timeWindow: 30
      trigger:
        operator: GreaterThan
        threshold: 3
      tags:
        foo: bar

var scheduledQueryRulesAlertResource = new Azure.Monitoring.ScheduledQueryRulesAlert("scheduledQueryRulesAlertResource", new()
{
    Action = new Azure.Monitoring.Inputs.ScheduledQueryRulesAlertActionArgs
    {
        ActionGroups = new[]
        {
            "string",
        },
        CustomWebhookPayload = "string",
        EmailSubject = "string",
    },
    Trigger = new Azure.Monitoring.Inputs.ScheduledQueryRulesAlertTriggerArgs
    {
        Operator = "string",
        Threshold = 0,
        MetricTrigger = new Azure.Monitoring.Inputs.ScheduledQueryRulesAlertTriggerMetricTriggerArgs
        {
            MetricTriggerType = "string",
            Operator = "string",
            Threshold = 0,
            MetricColumn = "string",
        },
    },
    TimeWindow = 0,
    DataSourceId = "string",
    ResourceGroupName = "string",
    Query = "string",
    Frequency = 0,
    Name = "string",
    Location = "string",
    Enabled = false,
    QueryType = "string",
    Description = "string",
    Severity = 0,
    Tags = 
    {
        { "string", "string" },
    },
    Throttling = 0,
    AutoMitigationEnabled = false,
    AuthorizedResourceIds = new[]
    {
        "string",
    },
});

example, err := monitoring.NewScheduledQueryRulesAlert(ctx, "scheduledQueryRulesAlertResource", &monitoring.ScheduledQueryRulesAlertArgs{
	Action: &monitoring.ScheduledQueryRulesAlertActionArgs{
		ActionGroups: pulumi.StringArray{
			pulumi.String("string"),
		},
		CustomWebhookPayload: pulumi.String("string"),
		EmailSubject:         pulumi.String("string"),
	},
	Trigger: &monitoring.ScheduledQueryRulesAlertTriggerArgs{
		Operator:  pulumi.String("string"),
		Threshold: pulumi.Float64(0),
		MetricTrigger: &monitoring.ScheduledQueryRulesAlertTriggerMetricTriggerArgs{
			MetricTriggerType: pulumi.String("string"),
			Operator:          pulumi.String("string"),
			Threshold:         pulumi.Float64(0),
			MetricColumn:      pulumi.String("string"),
		},
	},
	TimeWindow:        pulumi.Int(0),
	DataSourceId:      pulumi.String("string"),
	ResourceGroupName: pulumi.String("string"),
	Query:             pulumi.String("string"),
	Frequency:         pulumi.Int(0),
	Name:              pulumi.String("string"),
	Location:          pulumi.String("string"),
	Enabled:           pulumi.Bool(false),
	QueryType:         pulumi.String("string"),
	Description:       pulumi.String("string"),
	Severity:          pulumi.Int(0),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Throttling:            pulumi.Int(0),
	AutoMitigationEnabled: pulumi.Bool(false),
	AuthorizedResourceIds: pulumi.StringArray{
		pulumi.String("string"),
	},
})

var scheduledQueryRulesAlertResource = new ScheduledQueryRulesAlert("scheduledQueryRulesAlertResource", ScheduledQueryRulesAlertArgs.builder()
    .action(ScheduledQueryRulesAlertActionArgs.builder()
        .actionGroups("string")
        .customWebhookPayload("string")
        .emailSubject("string")
        .build())
    .trigger(ScheduledQueryRulesAlertTriggerArgs.builder()
        .operator("string")
        .threshold(0.0)
        .metricTrigger(ScheduledQueryRulesAlertTriggerMetricTriggerArgs.builder()
            .metricTriggerType("string")
            .operator("string")
            .threshold(0.0)
            .metricColumn("string")
            .build())
        .build())
    .timeWindow(0)
    .dataSourceId("string")
    .resourceGroupName("string")
    .query("string")
    .frequency(0)
    .name("string")
    .location("string")
    .enabled(false)
    .queryType("string")
    .description("string")
    .severity(0)
    .tags(Map.of("string", "string"))
    .throttling(0)
    .autoMitigationEnabled(false)
    .authorizedResourceIds("string")
    .build());

scheduled_query_rules_alert_resource = azure.monitoring.ScheduledQueryRulesAlert("scheduledQueryRulesAlertResource",
    action={
        "action_groups": ["string"],
        "custom_webhook_payload": "string",
        "email_subject": "string",
    },
    trigger={
        "operator": "string",
        "threshold": 0,
        "metric_trigger": {
            "metric_trigger_type": "string",
            "operator": "string",
            "threshold": 0,
            "metric_column": "string",
        },
    },
    time_window=0,
    data_source_id="string",
    resource_group_name="string",
    query="string",
    frequency=0,
    name="string",
    location="string",
    enabled=False,
    query_type="string",
    description="string",
    severity=0,
    tags={
        "string": "string",
    },
    throttling=0,
    auto_mitigation_enabled=False,
    authorized_resource_ids=["string"])

const scheduledQueryRulesAlertResource = new azure.monitoring.ScheduledQueryRulesAlert("scheduledQueryRulesAlertResource", {
    action: {
        actionGroups: ["string"],
        customWebhookPayload: "string",
        emailSubject: "string",
    },
    trigger: {
        operator: "string",
        threshold: 0,
        metricTrigger: {
            metricTriggerType: "string",
            operator: "string",
            threshold: 0,
            metricColumn: "string",
        },
    },
    timeWindow: 0,
    dataSourceId: "string",
    resourceGroupName: "string",
    query: "string",
    frequency: 0,
    name: "string",
    location: "string",
    enabled: false,
    queryType: "string",
    description: "string",
    severity: 0,
    tags: {
        string: "string",
    },
    throttling: 0,
    autoMitigationEnabled: false,
    authorizedResourceIds: ["string"],
});

type: azure:monitoring:ScheduledQueryRulesAlert
properties:
    action:
        actionGroups:
            - string
        customWebhookPayload: string
        emailSubject: string
    authorizedResourceIds:
        - string
    autoMitigationEnabled: false
    dataSourceId: string
    description: string
    enabled: false
    frequency: 0
    location: string
    name: string
    query: string
    queryType: string
    resourceGroupName: string
    severity: 0
    tags:
        string: string
    throttling: 0
    timeWindow: 0
    trigger:
        metricTrigger:
            metricColumn: string
            metricTriggerType: string
            operator: string
            threshold: 0
        operator: string
        threshold: 0