I have a several Linux vms (very dynamic environment) which sends SysLog to single Log Analytic Workspace. I would like to raise an Azure Alert whenever a warning appears in SysLog Log Analytic Workspace. How can I write a Custom Log Search to accomplish it?
The query I wrote:
| project _ResourceId, SyslogMessage, SeverityLevel, EventTime
| where SeverityLevel == 'warn'
can be consumed by Azure Monitor however if two machines produce Warning in the same alert period - only one Alert will be raised. What I would like to achieve is to have one query that is capable of producing multiple alerts.
Is it possible with logs?