az monitor scheduled-query

Is this page helpful?

Any additional feedback?

Feedback will be sent to Microsoft: By pressing the submit button, your feedback will be used to improve Microsoft products and services. Privacy policy.

Note

This reference is part of the scheduled-query extension for the Azure CLI (version 2.20.0 or higher). The extension will automatically install the first time you run an az monitor scheduled-query command. Learn more about extensions.

Commands to manage scheduled queries.

Commands

az monitor scheduled-query create	Create a scheduled query.
az monitor scheduled-query delete	Delete a scheduled query.
az monitor scheduled-query list	List all scheduled queries.
az monitor scheduled-query show	Show detail of a scheduled query.
az monitor scheduled-query update	Update a scheduled query.

az monitor scheduled-query create

Create a scheduled query.

az monitor scheduled-query create --condition
                                  --name
                                  --resource-group
                                  --scopes
                                  [--action-groups]
                                  [--auto-mitigate {false, true}]
                                  [--check-ws-alerts-storage {false, true}]
                                  [--condition-query]
                                  [--custom-properties]
                                  [--description]
                                  [--disabled {false, true}]
                                  [--evaluation-frequency]
                                  [--location]
                                  [--mad]
                                  [--severity]
                                  [--skip-query-validation {false, true}]
                                  [--tags]
                                  [--target-resource-type]
                                  [--window-size]

Examples

Create a scheduled query for a VM.

az monitor scheduled-query create -g {rg} -n {name1} --scopes {vm_id} --condition "count 'Placeholder_1' > 360 resource id _ResourceID at least 1 violations out of 5 aggregated points" --condition-query Placeholder_1="union Event, Syslog | where TimeGenerated > ago(1h) | where EventLevelName=='Error' or SeverityLevel=='err'" --description "Test rule"

Create a scheduled query for VMs in a resource group.

az monitor scheduled-query create -g {rg} -n {name1} --scopes {rg_id} --condition "count 'Placeholder_1' > 360 resource id _ResourceID at least 1 violations out of 5 aggregated points" --condition-query Placeholder_1="union Event, Syslog | where TimeGenerated > ago(1h) | where EventLevelName=='Error' or SeverityLevel=='err'" --description "Test rule"

Required Parameters

--condition

The condition which triggers the rule.

--name -n

Name of the scheduled query rule.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--scopes

Space-separated list of scopes the rule applies to. The resources specified in this parameter must be of the same type and exist in the same location.

Optional Parameters

--action-groups

Action Group resource Ids to invoke when the alert fires.

--auto-mitigate

The flag that indicates whether the alert should be automatically resolved or not. The default is true.

accepted values: false, true

default value: 1

--check-ws-alerts-storage --cwas

The flag which indicates whether this scheduled query rule should be stored in the customer's storage.

accepted values: false, true

--condition-query

Query deteils to replace the placeholders in --condition argument.

--custom-properties

The properties of an alert payload.

--description

Free-text description of the rule.

--disabled

Disable the scheduled query.

accepted values: false, true

--evaluation-frequency

Frequency with which to evaluate the rule in "##h##m##s" format.

default value: 5m

--location -l

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>.

--mad --mute-actions-duration

Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired.

--severity

Severity of the alert from 0 (critical) to 4 (verbose).

default value: 2

--skip-query-validation

The flag which indicates whether the provided query should be validated or not.

accepted values: false, true

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

--target-resource-type --type

The resource type of the target resource(s) in scopes. This must be provided when scopes is resource group or subscription.

--window-size

Time over which to aggregate metrics in "##h##m##s" format.

default value: 5m

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az monitor scheduled-query delete

Delete a scheduled query.

az monitor scheduled-query delete --name
                                  --resource-group
                                  [--yes]

Required Parameters

--name -n

Name of the scheduled query rule.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--yes -y

Do not prompt for confirmation.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az monitor scheduled-query list

List all scheduled queries.

az monitor scheduled-query list [--resource-group]

Optional Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az monitor scheduled-query show

Show detail of a scheduled query.

az monitor scheduled-query show --name
                                --resource-group

Required Parameters

--name -n

Name of the scheduled query rule.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az monitor scheduled-query update

Update a scheduled query.

az monitor scheduled-query update --name
                                  --resource-group
                                  [--action-groups]
                                  [--add]
                                  [--auto-mitigate {false, true}]
                                  [--check-ws-alerts-storage {false, true}]
                                  [--condition]
                                  [--condition-query]
                                  [--custom-properties]
                                  [--description]
                                  [--disabled {false, true}]
                                  [--evaluation-frequency]
                                  [--force-string]
                                  [--mad]
                                  [--remove]
                                  [--set]
                                  [--severity]
                                  [--skip-query-validation {false, true}]
                                  [--tags]
                                  [--target-resource-type]
                                  [--window-size]

Required Parameters

--name -n

Name of the scheduled query rule.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Optional Parameters

--action-groups

Action Group resource Ids to invoke when the alert fires.

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

--auto-mitigate

The flag that indicates whether the alert should be automatically resolved or not. The default is true.

accepted values: false, true

--check-ws-alerts-storage --cwas

The flag which indicates whether this scheduled query rule should be stored in the customer's storage.

accepted values: false, true

--condition

The condition which triggers the rule.

--condition-query

Query deteils to replace the placeholders in --condition argument.

--custom-properties

The properties of an alert payload.

--description

Free-text description of the rule.

--disabled

Disable the scheduled query.

accepted values: false, true

--evaluation-frequency

Frequency with which to evaluate the rule in "##h##m##s" format.

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

--mad --mute-actions-duration

Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired.

--remove

Remove a property or an element from a list. Example: --remove property.list OR --remove propertyToRemove.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=.

--severity

Severity of the alert from 0 (critical) to 4 (verbose).

--skip-query-validation

The flag which indicates whether the provided query should be validated or not.

accepted values: false, true

--tags

Space-separated tags: key[=value] [key[=value] ...]. Use "" to clear existing tags.

--target-resource-type --type

The resource type of the target resource(s) in scopes. This must be provided when scopes is resource group or subscription.

--window-size

Time over which to aggregate metrics in "##h##m##s" format.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.