Export ARM Template for Azure Log analytics Alerts created from Portal
Asked Answered
P

2

7

I have created Azure Log Analytics (Monitor) Alert to monitor the Logic App Failures and I have done this using Azure portal. I would like to know how can we export the Alert created from Azure Portal as an ARM template? Anyone know how we can achieve it.

Thanks enter image description here

enter image description here

Preordain answered 2/4, 2020 at 23:0 Comment(0)
S
16

If you want to export the ARM template of the alert in the portal, please follow the steps below.

1.In the portal, navigate to the resource group which the alert located in(Note: It is the group of the alert, not the group of the alert's target resource), select the Show hidden types option -> find your alert and select it -> click Export Template.

enter image description here

2.Click the Download like below, then it will download the template as a compressed file which includes the template.json and parameters.json to local.

enter image description here

Update:

What you are using is legacy Log Analytics Alert, from June 1, 2019, it automatically use new scheduledQueryRules by default in Azure portal, its resource type is microsoft.insights/scheduledqueryrules.

In your case, you could follow this link to switch from the old alert to new one.

Or create a new alert in the portal, navigate to the Log Analytics workspace in the portal -> New alert rule -> Add Custom log search and create it.

enter image description here

Ater create it, in the resource group, select the Show hidden types option, you will find the alert like below, then you can export the template.

enter image description here

Simoneaux answered 3/4, 2020 at 7:28 Comment(6)
Thank you Joy, I gave it a try but this does not still show me My Alert that I created in Log Analytics (I ensured I selected SHOW HIDDEN and also selected resource group of the Alert not the Target resource). Not sure if this method works for Log analytics alerts I can see Application Insights Alerts though.Preordain
@Preordain Please show the screenshot of your alert in the portal.Simoneaux
hi @Joy Wang I have updated my original post with the screenshot, both of the Alert and of the Resource group.Preordain
@Preordain I will look into it later.Simoneaux
No worries, Thank you @Joy-wang , basically I created a Alert from Log Analytics workspace using a CUSTOM LOG SEARCH criteria (query) and it shows as ResourceType (Microsoft.OperationalInsights).Preordain
Thank you @Joy-wang this helps.Preordain
F
0

You are using the legacy log analytics API and this doesn't support export for templates as they are not ARM tracked resources. The definition for those would be on the workspace itself (under savedsearch => schedule => action). If you want to be able to export more easily, please consider using the newer ScheduledQueryRules API. Learn more on how to switch here: https://learn.microsoft.com/azure/azure-monitor/platform/alerts-log-api-switch#process-of-switching-from-legacy-log-alerts-api

Please note this could be a big change due to API change, please review the complete article to understand what will happen after the switch.

Flameproof answered 6/4, 2020 at 9:50 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.