Azure log alert rule created successfully with ARM template but not appearing in portal

3
votes

I have created a few ARM templates for deploying Azure metric alert rules, but I now have a requirement to deploy a log alert rule (i.e. a rule based on an Application Insights query rather than a platform metric).

I have scripted the template following the example here (which suggests I need to create a resource of type Microsoft.Insights/scheduledQueryRules) and deployed using Azure portal's Template Deployment service as described here.

Azure reports the deployment as successful, and the activity log gives me the deployment result, including the ID of my new resource e.g. /subscriptions/[subscription-id]/resourcegroups/[alerts-resource-group]/providers/Microsoft.Insights/scheduledQueryRules/Custom errors spike alert.

However, when I navigate to the Monitor blade in subscription [subscription-id], and filter down by resource group [alerts-resource-group] I don't see my new alert.

As a sanity check I created a metric alert using the same process targeting the same App Insights resource, and this one does show up in the Monitor blade.

I guess my question is, am I misunderstanding something about log-based alert rules? For example, does an Azure 'resource' of type Microsoft.Insights/scheduledQueryRules equate with alert rules of signal type Log Search in Monitor / Alerts / Manage alert rules? I'm confident my template is correct because it passes validation and completed successfully. But I'm baffled about where the alert rule is ending up!

One thing I should mention is that I'm creating the alert rule in a different resource group to the App Insights instance itself, but this is also true of the metric alert so assumed this wasn't significant.

1
azureazure-devopsarm-templateazure-monitoring

1 Answers

5
votes

It turns out log alerts require a hidden link to the resource they're monitoring. Otherwise they get created but not listed anywhere in the portal.

In my case I added the following variable to the template:

"linkToAiResource" : "[concat('hidden-link:', resourceId('microsoft.insights/components', parameters('appInsightsResourceName')))]"

Then included this as a tag in the resource definition like this:

"tags": {
    "[variables('linkToAiResource')]": "Resource"
}

Once redeployed the alert rule appears in the portal's Monitor blade.