Azure ARM 无法解析 |字符

Question

当我尝试部署自定义日志警报时，我遇到了一个问题，即 ARM 模板无法解析我尝试传递的查询。

错误：

有人可以告诉我如何避免这种情况吗？我试图转义字符，将其硬编码到模板中，但这似乎不起作用。

这是我正在使用的模板资源：

{
            "type": "Microsoft.Insights/scheduledQueryRules",
            "name": "Sample log query alert",
            "apiVersion": "2018-04-16",
            "location": "global",
            "properties": {
                "description": "[parameters('alertDescription')]",
                "enabled": "[parameters('isEnabled')]",
                "source": {
                    "query": "requests | project timestamp, operation_Name, success, cloud_RoleName | where timestamp > ago(5m) | where cloud_RoleName =~ 'appName' and operation_Name =~ 'functionName' and success == false",
                    "dataSourceId": "[resourceId('Microsoft.insights/components',parameters('applicationInsightsName'))]",
                    "queryType": "ResultCount"
                },
                "schedule": {
                    "frequencyInMinutes": 1,
                    "timeWindowInMinutes": 5
                },
                "action": {
                    "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction",
                    "severity": "[parameters('alertSeverity')]",
                    "aznsAction": {
                        "actionGroup": [
                          "[resourceId('Microsoft.Insights/actionGroups',parameters('actionGroupName'))]"
                        ]
                    }
                },
                "trigger": {
                    "thresholdOperator": "GreaterThan",
                    "threshold": 0
                }
            }
        }

这是我尝试使用的查询：

requests | project timestamp, operation_Name, success, cloud_RoleName | where timestamp > ago(5m) | where cloud_RoleName =~ 'appName' and operation_Name =~ 'functionName' and success == false
                

参考： https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-log#create-a-log-alert-rule-with-the-azure-portal

https://devblogs.microsoft.com/premier-developer/alerts-based-on-analytics-query-using-custom-log-search/

Answer 1

对于字符|，请确保它是英文字符，并在模板中硬编码。

我在我身边测试它，它工作正常。这是我的template.json：

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "scheduledqueryrules_my_test_222_name": {
            "defaultValue": "my test 33300",
            "type": "String"
        },
        "components_yyinsights333_externalid": {
            "defaultValue": "/subscriptions/xxxxx/resourceGroups/xxxxx/providers/microsoft.insights/components/yyinsights333",
            "type": "String"
        },
        "actiongroups_yyactiongroup11_externalid": {
            "defaultValue": "/subscriptions/xxxx/resourceGroups/xxxx/providers/microsoft.insights/actiongroups/yyactiongroup11",
            "type": "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "microsoft.insights/scheduledqueryrules",
            "apiVersion": "2018-04-16",
            "name": "[parameters('scheduledqueryrules_my_test_222_name')]",
            "location": "westus2",
            "properties": {
                "enabled": "true",
                "source": {
                    "query": "requests | project timestamp, operation_Name, success, cloud_RoleName | where timestamp > ago(5m) | where cloud_RoleName =~ 'appName' and operation_Name =~ 'functionName' and success == false",
                    "authorizedResources": [],
                    "dataSourceId": "[parameters('components_yyinsights333_externalid')]",
                    "queryType": "ResultCount"
                },
                "schedule": {
                    "frequencyInMinutes": 5,
                    "timeWindowInMinutes": 5
                },
                "action": {
                    "severity": "3",
                    "aznsAction": {
                        "actionGroup": [
                            "[parameters('actiongroups_yyactiongroup11_externalid')]"
                        ]
                    },
                    "trigger": {
                        "thresholdOperator": "GreaterThan",
                        "threshold": 20
                    },
                    "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction"
                }
            }
        }
    ]
}

这里是parameters.json：

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
      "scheduledqueryrules_my_test_222_name": {
        "value": "my test 33300"
      },
      "components_yyinsights333_externalid": {
        "value": "/subscriptions/xxx/resourceGroups/xxx/providers/microsoft.insights/components/yyinsights333"
      },
      "actiongroups_yyactiongroup11_externalid": {
        "value": "/subscriptions/xxx/resourceGroups/xxx/providers/microsoft.insights/actiongroups/yyactiongroup11"
      }
    }
}

使用 powershell 部署：

请复制粘贴我的 .json 文件试试看，如果您有更多问题，请告诉我。

另一种解决方案是，您可以先在 azure 门户中通过 UI 手动创建此警报，创建后导航到此警报规则 -> 并复制 azure 生成的模板文件 -> 然后使用正确的 json 文件部署您的警报。下面是如何检查自动生成的模板的截图：