Raising Alerts from Application Insights log based on percentage?

Question

I can write a query in application insights that gives me a percentage as a scalar. I want to create alert if that percentage is > X . How can this be done using log based alerts?

Basically, I have a lot of machines that send telemetry to application insights. Sometimes they log some exceptions. I send MachineName in customDimensions for all the logs. So I can get the names of all the machines that sent logs in last 24 hours. The exceptions are also sent with MachineName in customDimensions. When a particular error is raised by more than X% machines in last 24 hours, I want to raise an alert.

The way to write alert logic is using 'Number of Results' which cannot be used for this since it automatically adds '|count' to the query. The other way is using 'Metric Measurement', which I am guessing should help me raise an alert like this but I'm unable to figure out how.

I can get the total machine count by this query:

let num_machines = traces
| summarize by tostring(customDimensions["MachineName"])
| count;

I can get the number of machines that reported an exception like this:

let num_error_machines = exceptions
| where customDimensions["Message"] contains "ExceptionXRaised"
| summarize by tostring(customDimensions["MachineName"])
| count;

finally, i can get the percentage of machines that raised the issue like this:

print toscalar(num_error_machines)*100/toscalar(num_machines)

I am not sure how to use this result to raise an alert using MetricMeasurement. This needs to be modified somehow to get AggregatedValue and use bin, I am not sure if that is possible / how that query will be.

Did you mean that you have a query which queries all the exceptions and you can set a specific error name as a query parameter and you can get distinct machine names. Then you can get the count of sending error machines, use this count to ' / ' the total count of all machines to get the percentage, and compare with X. If you don't know how to create alert, you can refer to this doc and if you don't know how to write a query, could you pls add more details on your scenario? — tiny-wa
Sorry for my late response, I've added some details below, I mean that I haven't found way to alert via percentage and it's easy to alert via exception machines. You can set a estimated value(e.g. you have 10 machines in total so you can set the value as 8), if you can make sure the total number of machines, it will have the same result as percentage. And if you don't know the total number or it's a dynamic value, you may set an approximate number. — tiny-wa

tiny-wa tiny-wa · Accepted Answer · 2021-04-15T05:56:05

Sorry for the late reply. I've tested in my side and met many problems indeed.

I found that alert rule doesn't support to monitor the percentage number of the result, it only supports the numbers of query result and Metric measurement. So I think you may give up the percentage and use the num_err_machine like the screenshot below

Pls note, you can't append " ; " at the end of the query or it will give an error like The request had some invalid properties

Raising Alerts from Application Insights log based on percentage?

1 Answers