Set multiple threshold on a log based kusto query

Question

I have set up a log-based alert in Microsoft Azure. The deployment of the alerts done via ARM template. Where you can input your query and set threshold like below.

 "triggerThresholdOperator": {
        "value": "GreaterThan"
      },
      "triggerThreshold": {
        "value": 0
      },
      "frequencyInMinutes": {
        "value":15
      },
      "timeWindowInMinutes": {
        "value": 15
      },
      "severityLevel": {
        "value": "0"
      },
      "appInsightsQuery": {
        "value": "exceptions\r\n| where A_ != '2000' \r\n| where A_ != '4000' \r\n| where A_ != '3000' "
      }

As far as I understand we can only set threshold once ON an entire query.

Questions: I have multiple statements in my query which I am excluding since it's just a noise. But now I want to set a threshold on value 3000 to 5 and also want to set a time-window to 30 in the same query. meaning only exclude 3000 when it occurs 5 times in the last 30 minutes(when query get run).

exceptions
| where A_ != '2000' 
| where A_ != '4000' 
| where A_ != '3000'

I am pretty sure that I can't set a threshold like this in the query and the only workaround is to create a new alert just for value 3000 and set a threshold in ARM template. I haven't found any heavy threshold/time filters in Aure. Is there any way I can set multiple thresholds and time filters in a single query? which is again getting checked by different threshold and time filetrs in the ARM template.

Thanks.

KustoKing KustoKing · Accepted Answer · 2021-01-03T21:14:32

I don't fully understand your question.

But for your time window question you could do something like

exceptions
| summarize count() by A_, bin(TimeGenerated, 30m)

That way you will get a count of A_ in blocks of 30 minutes.

Another way would be to do:

let Materialized = materialize(
exceptions
| summarize Count=count(A_) by bin(TimeGenerated, 30m)
); 
Materialized | where Count == 10

But then again it all depends on what you would like to achieve

Set multiple threshold on a log based kusto query

2 Answers