Microsoft.Insights scheduledQueryRules 2022-06-15

Article
02/13/2025

Remarks

For guidance on deploying monitoring solutions, see Create monitoring resources by using Bicep.

Bicep resource definition

The scheduledQueryRules resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Insights/scheduledQueryRules@2022-06-15' = {
  kind: 'string'
  location: 'string'
  name: 'string'
  properties: {
    actions: {
      actionGroups: [
        'string'
      ]
      customProperties: {
        {customized property}: 'string'
      }
    }
    autoMitigate: bool
    checkWorkspaceAlertsStorageConfigured: bool
    criteria: {
      allOf: [
        {
          dimensions: [
            {
              name: 'string'
              operator: 'string'
              values: [
                'string'
              ]
            }
          ]
          failingPeriods: {
            minFailingPeriodsToAlert: int
            numberOfEvaluationPeriods: int
          }
          metricMeasureColumn: 'string'
          metricName: 'string'
          operator: 'string'
          query: 'string'
          resourceIdColumn: 'string'
          threshold: int
          timeAggregation: 'string'
        }
      ]
    }
    description: 'string'
    displayName: 'string'
    enabled: bool
    evaluationFrequency: 'string'
    muteActionsDuration: 'string'
    overrideQueryTimeRange: 'string'
    scopes: [
      'string'
    ]
    severity: int
    skipQueryValidation: bool
    targetResourceTypes: [
      'string'
    ]
    windowSize: 'string'
  }
  tags: {
    {customized property}: 'string'
  }
}

Property Values

Actions

Name	Description	Value
actionGroups	Action Group resource Ids to invoke when the alert fires.	string[]
customProperties	The properties of an alert payload.	ActionsCustomProperties

ActionsCustomProperties

Name	Description	Value

Condition

Name	Description	Value
dimensions	List of Dimensions conditions	Dimension[]
failingPeriods	The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.	ConditionFailingPeriods
metricMeasureColumn	The column containing the metric measure number. Relevant only for rules of the kind LogAlert.	string
metricName	The name of the metric to be sent. Relevant and required only for rules of the kind LogToMetric.	string
operator	The criteria operator. Relevant and required only for rules of the kind LogAlert.	'Equals' 'GreaterThan' 'GreaterThanOrEqual' 'LessThan' 'LessThanOrEqual'
query	Log query alert	string
resourceIdColumn	The column containing the resource id. The content of the column must be a uri formatted as resource id. Relevant only for rules of the kind LogAlert.	string
threshold	the criteria threshold value that activates the alert. Relevant and required only for rules of the kind LogAlert.	int
timeAggregation	Aggregation type. Relevant and required only for rules of the kind LogAlert.	'Average' 'Count' 'Maximum' 'Minimum' 'Total'

ConditionFailingPeriods

Name	Description	Value
minFailingPeriodsToAlert	The number of violations to trigger an alert. Should be smaller or equal to numberOfEvaluationPeriods. Default value is 1	int
numberOfEvaluationPeriods	The number of aggregated lookback points. The lookback time window is calculated based on the aggregation granularity (windowSize) and the selected number of aggregated points. Default value is 1	int

Dimension

Name	Description	Value
name	Name of the dimension	string (required)
operator	Operator for dimension values	'Exclude' 'Include' (required)
values	List of dimension values	string[] (required)

Microsoft.Insights/scheduledQueryRules

Name	Description	Value
kind	Indicates the type of scheduled query rule. The default is LogAlert.	'LogAlert' 'LogToMetric'
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^[^#<>%&:\?/{}*]{1,260}$` (required)
properties	The rule properties of the resource.	ScheduledQueryRuleProperties (required)
tags	Resource tags	Dictionary of tag names and values. See Tags in templates

ScheduledQueryRuleCriteria

Name	Description	Value
allOf	A list of conditions to evaluate against the specified scopes	Condition[]

ScheduledQueryRuleProperties

Name	Description	Value
actions	Actions to invoke when the alert fires.	Actions
autoMitigate	The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of the kind LogAlert.	bool
checkWorkspaceAlertsStorageConfigured	The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.	bool
criteria	The rule criteria that defines the conditions of the scheduled query rule.	ScheduledQueryRuleCriteria
description	The description of the scheduled query rule.	string
displayName	The display name of the alert rule	string
enabled	The flag which indicates whether this scheduled query rule is enabled. Value should be true or false	bool
evaluationFrequency	How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.	string
muteActionsDuration	Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.	string
overrideQueryTimeRange	If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.	string
scopes	The list of resource id's that this scheduled query rule is scoped to.	string[]
severity	Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.	int
skipQueryValidation	The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.	bool
targetResourceTypes	List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert	string[]
windowSize	The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.	string

ScheduledQueryRuleResourceTags

Name	Description	Value

Usage Examples

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

Module	Description
Scheduled Query Rule	AVM Resource Module for Scheduled Query Rule

ARM template resource definition

The scheduledQueryRules resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following JSON to your template.

{
  "type": "Microsoft.Insights/scheduledQueryRules",
  "apiVersion": "2022-06-15",
  "name": "string",
  "kind": "string",
  "location": "string",
  "properties": {
    "actions": {
      "actionGroups": [ "string" ],
      "customProperties": {
        "{customized property}": "string"
      }
    },
    "autoMitigate": "bool",
    "checkWorkspaceAlertsStorageConfigured": "bool",
    "criteria": {
      "allOf": [
        {
          "dimensions": [
            {
              "name": "string",
              "operator": "string",
              "values": [ "string" ]
            }
          ],
          "failingPeriods": {
            "minFailingPeriodsToAlert": "int",
            "numberOfEvaluationPeriods": "int"
          },
          "metricMeasureColumn": "string",
          "metricName": "string",
          "operator": "string",
          "query": "string",
          "resourceIdColumn": "string",
          "threshold": "int",
          "timeAggregation": "string"
        }
      ]
    },
    "description": "string",
    "displayName": "string",
    "enabled": "bool",
    "evaluationFrequency": "string",
    "muteActionsDuration": "string",
    "overrideQueryTimeRange": "string",
    "scopes": [ "string" ],
    "severity": "int",
    "skipQueryValidation": "bool",
    "targetResourceTypes": [ "string" ],
    "windowSize": "string"
  },
  "tags": {
    "{customized property}": "string"
  }
}

Property Values

Actions

Name	Description	Value
actionGroups	Action Group resource Ids to invoke when the alert fires.	string[]
customProperties	The properties of an alert payload.	ActionsCustomProperties

ActionsCustomProperties

Name	Description	Value

Condition

Name	Description	Value
dimensions	List of Dimensions conditions	Dimension[]
failingPeriods	The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.	ConditionFailingPeriods
metricMeasureColumn	The column containing the metric measure number. Relevant only for rules of the kind LogAlert.	string
metricName	The name of the metric to be sent. Relevant and required only for rules of the kind LogToMetric.	string
operator	The criteria operator. Relevant and required only for rules of the kind LogAlert.	'Equals' 'GreaterThan' 'GreaterThanOrEqual' 'LessThan' 'LessThanOrEqual'
query	Log query alert	string
resourceIdColumn	The column containing the resource id. The content of the column must be a uri formatted as resource id. Relevant only for rules of the kind LogAlert.	string
threshold	the criteria threshold value that activates the alert. Relevant and required only for rules of the kind LogAlert.	int
timeAggregation	Aggregation type. Relevant and required only for rules of the kind LogAlert.	'Average' 'Count' 'Maximum' 'Minimum' 'Total'

ConditionFailingPeriods

Name	Description	Value
minFailingPeriodsToAlert	The number of violations to trigger an alert. Should be smaller or equal to numberOfEvaluationPeriods. Default value is 1	int
numberOfEvaluationPeriods	The number of aggregated lookback points. The lookback time window is calculated based on the aggregation granularity (windowSize) and the selected number of aggregated points. Default value is 1	int

Dimension

Name	Description	Value
name	Name of the dimension	string (required)
operator	Operator for dimension values	'Exclude' 'Include' (required)
values	List of dimension values	string[] (required)

Microsoft.Insights/scheduledQueryRules

Name	Description	Value
apiVersion	The api version	'2022-06-15'
kind	Indicates the type of scheduled query rule. The default is LogAlert.	'LogAlert' 'LogToMetric'
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^[^#<>%&:\?/{}*]{1,260}$` (required)
properties	The rule properties of the resource.	ScheduledQueryRuleProperties (required)
tags	Resource tags	Dictionary of tag names and values. See Tags in templates
type	The resource type	'Microsoft.Insights/scheduledQueryRules'

ScheduledQueryRuleCriteria

Name	Description	Value
allOf	A list of conditions to evaluate against the specified scopes	Condition[]

ScheduledQueryRuleProperties

Name	Description	Value
actions	Actions to invoke when the alert fires.	Actions
autoMitigate	The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of the kind LogAlert.	bool
checkWorkspaceAlertsStorageConfigured	The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.	bool
criteria	The rule criteria that defines the conditions of the scheduled query rule.	ScheduledQueryRuleCriteria
description	The description of the scheduled query rule.	string
displayName	The display name of the alert rule	string
enabled	The flag which indicates whether this scheduled query rule is enabled. Value should be true or false	bool
evaluationFrequency	How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.	string
muteActionsDuration	Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.	string
overrideQueryTimeRange	If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.	string
scopes	The list of resource id's that this scheduled query rule is scoped to.	string[]
severity	Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.	int
skipQueryValidation	The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.	bool
targetResourceTypes	List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert	string[]
windowSize	The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.	string

ScheduledQueryRuleResourceTags

Name	Description	Value

Usage Examples

Azure Quickstart Templates

The following Azure Quickstart templates deploy this resource type.

Template	Description
Create alert rule for azure business continuity items	This templates creates an alert rule and user assigned MSI. It also assigns the MSI reader access to the subscription so that the alert rule has access to query the required protected items and latest recovery point details.

Terraform (AzAPI provider) resource definition

The scheduledQueryRules resource type can be deployed with operations that target:

Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Insights/scheduledQueryRules resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Insights/scheduledQueryRules@2022-06-15"
  name = "string"
  kind = "string"
  location = "string"
  tags = {
    {customized property} = "string"
  }
  body = jsonencode({
    properties = {
      actions = {
        actionGroups = [
          "string"
        ]
        customProperties = {
          {customized property} = "string"
        }
      }
      autoMitigate = bool
      checkWorkspaceAlertsStorageConfigured = bool
      criteria = {
        allOf = [
          {
            dimensions = [
              {
                name = "string"
                operator = "string"
                values = [
                  "string"
                ]
              }
            ]
            failingPeriods = {
              minFailingPeriodsToAlert = int
              numberOfEvaluationPeriods = int
            }
            metricMeasureColumn = "string"
            metricName = "string"
            operator = "string"
            query = "string"
            resourceIdColumn = "string"
            threshold = int
            timeAggregation = "string"
          }
        ]
      }
      description = "string"
      displayName = "string"
      enabled = bool
      evaluationFrequency = "string"
      muteActionsDuration = "string"
      overrideQueryTimeRange = "string"
      scopes = [
        "string"
      ]
      severity = int
      skipQueryValidation = bool
      targetResourceTypes = [
        "string"
      ]
      windowSize = "string"
    }
  })
}

Property Values

Actions

Name	Description	Value
actionGroups	Action Group resource Ids to invoke when the alert fires.	string[]
customProperties	The properties of an alert payload.	ActionsCustomProperties

ActionsCustomProperties

Name	Description	Value

Condition

Name	Description	Value
dimensions	List of Dimensions conditions	Dimension[]
failingPeriods	The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert.	ConditionFailingPeriods
metricMeasureColumn	The column containing the metric measure number. Relevant only for rules of the kind LogAlert.	string
metricName	The name of the metric to be sent. Relevant and required only for rules of the kind LogToMetric.	string
operator	The criteria operator. Relevant and required only for rules of the kind LogAlert.	'Equals' 'GreaterThan' 'GreaterThanOrEqual' 'LessThan' 'LessThanOrEqual'
query	Log query alert	string
resourceIdColumn	The column containing the resource id. The content of the column must be a uri formatted as resource id. Relevant only for rules of the kind LogAlert.	string
threshold	the criteria threshold value that activates the alert. Relevant and required only for rules of the kind LogAlert.	int
timeAggregation	Aggregation type. Relevant and required only for rules of the kind LogAlert.	'Average' 'Count' 'Maximum' 'Minimum' 'Total'

ConditionFailingPeriods

Name	Description	Value
minFailingPeriodsToAlert	The number of violations to trigger an alert. Should be smaller or equal to numberOfEvaluationPeriods. Default value is 1	int
numberOfEvaluationPeriods	The number of aggregated lookback points. The lookback time window is calculated based on the aggregation granularity (windowSize) and the selected number of aggregated points. Default value is 1	int

Dimension

Name	Description	Value
name	Name of the dimension	string (required)
operator	Operator for dimension values	'Exclude' 'Include' (required)
values	List of dimension values	string[] (required)

Microsoft.Insights/scheduledQueryRules

Name	Description	Value
kind	Indicates the type of scheduled query rule. The default is LogAlert.	'LogAlert' 'LogToMetric'
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^[^#<>%&:\?/{}*]{1,260}$` (required)
properties	The rule properties of the resource.	ScheduledQueryRuleProperties (required)
tags	Resource tags	Dictionary of tag names and values.
type	The resource type	"Microsoft.Insights/scheduledQueryRules@2022-06-15"

ScheduledQueryRuleCriteria

Name	Description	Value
allOf	A list of conditions to evaluate against the specified scopes	Condition[]

ScheduledQueryRuleProperties

Name	Description	Value
actions	Actions to invoke when the alert fires.	Actions
autoMitigate	The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of the kind LogAlert.	bool
checkWorkspaceAlertsStorageConfigured	The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert.	bool
criteria	The rule criteria that defines the conditions of the scheduled query rule.	ScheduledQueryRuleCriteria
description	The description of the scheduled query rule.	string
displayName	The display name of the alert rule	string
enabled	The flag which indicates whether this scheduled query rule is enabled. Value should be true or false	bool
evaluationFrequency	How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert.	string
muteActionsDuration	Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert.	string
overrideQueryTimeRange	If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert.	string
scopes	The list of resource id's that this scheduled query rule is scoped to.	string[]
severity	Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert.	int
skipQueryValidation	The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert.	bool
targetResourceTypes	List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert	string[]
windowSize	The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert.	string

ScheduledQueryRuleResourceTags

Name	Description	Value

Usage Examples

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

Module	Description
Scheduled Query Rule	AVM Resource Module for Scheduled Query Rule

Share via

Microsoft.Insights scheduledQueryRules 2022-06-15

Remarks

Bicep resource definition

Resource format

Property Values

Actions

ActionsCustomProperties

Condition

ConditionFailingPeriods

Dimension

Microsoft.Insights/scheduledQueryRules

ScheduledQueryRuleCriteria

ScheduledQueryRuleProperties

ScheduledQueryRuleResourceTags

Usage Examples

Azure Verified Modules

ARM template resource definition

Resource format

Property Values

Actions

ActionsCustomProperties

Condition

ConditionFailingPeriods

Dimension

Microsoft.Insights/scheduledQueryRules

ScheduledQueryRuleCriteria

ScheduledQueryRuleProperties

ScheduledQueryRuleResourceTags

Usage Examples

Azure Quickstart Templates

Terraform (AzAPI provider) resource definition

Resource format

Property Values

Actions

ActionsCustomProperties

Condition

ConditionFailingPeriods

Dimension

Microsoft.Insights/scheduledQueryRules

ScheduledQueryRuleCriteria

ScheduledQueryRuleProperties

ScheduledQueryRuleResourceTags

Usage Examples

Azure Verified Modules

Feedback

Additional resources