Create or update an alert rule in Azure Monitor REST API
Updated: September 26, 2016
See Common headers and parameters for headers and parameters that are used by all requests related to alerts.
Method | Request URI |
|---|---|
PUT | https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/microsoft.insights/alertRules/{alert-rule-name}?api-version={api-version} |
Replace {alert-rule-name} with the name of the alert rule for which you want to create or update.
{
"location": "eastus",
"tags": { },
"properties": {
"name": "CPUHigh Plan",
"description": "The average CPU is high across all the instances of Plan",
"isEnabled": true,
"condition": {
"odata.type": "Microsoft.Azure.Management.Insights.Models.ThresholdRuleCondition",
"dataSource": {
"odata.type": "Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource",
"resourceUri": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/Default-Storage-NorthCentralUS/providers/Microsoft.Web/serverfarms/Plan",
"metricName": "CpuPercentage",
"operator": "GreaterThan"
},
"threshold": 90,
"windowSize": "PT15M",
"timeAggregation": "Average"
},
"actions": [
{
"odata.type": "Microsoft.Azure.Management.Insights.Models.RuleEmailAction",
"sendToServiceOwners": true,
"customEmails": ["email1@contoso.com","email2@contoso.com" ]
},
{
"odata.type": "Microsoft.Azure.Management.Insights.Models.RuleWebhookAction",
"serviceUri": "http://contoso.com/",
"properties": { }
}
]
}
}
Element Name | Required | Type | Description |
|---|---|---|---|
location | Yes | String | Specifies the supported Azure location of the alert rule. For more information, see List all of the available geo-locations. |
tags | No | Complex Type | The tags and their values that are used by the alert rule. |
name | Yes | String | The name of the alert rule. |
description | Yes | String | Description of the alert rule that will be included in the alert email. |
isEnabled | Yes | Boolean | Indicates whether the alert rule is enabled. |
condition | Yes | Complex Type | The condition that results in the alert rule being activated. |
actions | Yes | Complex Type | Array of actions that are performed when the alert rule becomes active, and when an alert condition is resolved. |
The condition can vary depending on its type. There are currently 3 types of conditions. The first is based on the threshold for a metric you define:
Element Name | Description |
|---|---|
odata.type | Always Microsoft.Azure.Management.Insights.Models.ThresholdRuleCondition |
dataSource | Always Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource |
resourceUri | The resource identifier of the resource the rule monitors. |
metricName | The name of the metric that defines what the rule monitors. |
operator | The operator used to compare the data and the threshold. |
threshold | The threshold value that activates the alert. |
windowSize | The period of time that is used to monitor alert activity based on the threshold. Must be between 5 minutes and 1 day. ISO 8601 duration format. |
timeAggregation | How the data that is collected should be combined over time. The default value is Average. |
The second is based on the number of failures that a web test has:
{
"odata.type": "Microsoft.Azure.Management.Insights.Models.LocationThresholdRuleCondition",
"dataSource": {
"odata.type": "Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource",
"resourceUri": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourcegroups/Default-Web-CentralUS/providers/microsoft.insights/webtests/homepagetest-newrelapp2",
"metricName": "GSMT_AvRaW"
},
"windowSize": "PT5M",
"failedLocationCount": 1
}
Element Name | Description |
|---|---|
odata.type | Always Microsoft.Azure.Management.Insights.Models.LocationThresholdRuleCondition |
dataSource | Always Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource |
resourceUri | The resource identifier of the resource the rule monitors. |
metricName | The name of the metric that defines what the rule monitors. |
failedLocationCount | The number of locations that must fail to activate the alert. |
windowSize | The period of time that is used to monitor alert activity based on the threshold. Must be between 5 minutes and 1 day. ISO 8601 duration format. |
The third is on the occurrences of management events:
{
"odata.type": "Microsoft.Azure.Management.Insights.Models.ManagementEventRuleCondition",
"dataSource": {
"odata.type": "Microsoft.Azure.Management.Insights.Models.RuleManagementEventDataSource",
"operationName": "",
"resourceUri": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/Default-Web-CentralUS/providers/Microsoft.Web/sites/TestLatestWebsite",
"status": "failed",
"claims": { }
},
"aggregation": {
"threshold": 1,
"windowSize": "PT5M"
}
}
Element Name | Description |
|---|---|
odata.type | Always Microsoft.Azure.Management.Insights.Models.ManagementEventRuleCondition |
dataSource | Always Microsoft.Azure.Management.Insights.Models.RuleManagementEventDataSource |
operationName | The name of the operation that should be checked for. If no name is provided, any operation will match. |
resourceUri | The resource identifier of the resource the rule monitors. |
status | The status of the operation that should be checked for. If no status is provided, any status will match. |
claims | The status of the operation that should be checked for. If no status is provided, any status will match. |
aggregation | How the data that is collected should be combined over time. Note that for management event alerts aggregation is optional – if it is not provided then any event will cause the alert to activate. |
threshold | The threshold value that activates the alert. |
windowSize | The period of time that is used to monitor alert activity based on the threshold. Must be between 5 minutes and 1 day. ISO 8601 duration format. |
Finally, the action is what should happen when the condition is met. There are two types of possible actions that occur when the alert is activated or resolved. First is to send email.
Element Name | Description |
|---|---|
odata.type | Always Microsoft.Azure.Management.Insights.Models.RuleEmailAction |
sendToServiceOwners | Whether the administrators (service and co-administrators) of the service should be notified when the alert is activated. |
customEmails | A list of administrator's custom email addresses notify of the activation of the alert. |
The second is to call a webhook.
Element Name | Description |
|---|---|
odata.type | Always Microsoft.Azure.Management.Insights.Models.RuleWebhookAction |
serviceUri | The URI called when the alert activates or resolves. |
properties | A list of custom JSON properties to append to the webhook payload. |
Status code: 200.
{
"id": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/Default-Web-NorthCentralUS/providers/microsoft.insights/alertrules/CPUHigh%20Plan",
"location": "eastus",
"tags": { },
"properties": {
"name": "CPUHigh Plan",
"description": "The average CPU is high across all the instances of Plan",
"isEnabled": true,
"condition": {
"odata.type": "Microsoft.Azure.Management.Insights.Models.ThresholdRuleCondition",
"dataSource": {
"odata.type": "Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource",
"resourceUri": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/Default-Storage-NorthCentralUS/providers/Microsoft.Web/serverfarms/Plan",
"metricName": "CpuPercentage",
"operator": "GreaterThan"
},
"threshold": 90,
"windowSize": "PT15M",
"timeAggregation": "Average"
},
"actions": [
{
"odata.type": "Microsoft.Azure.Management.Insights.Models.RuleEmailAction",
"sendToServiceOwners": true,
"customEmails": [ ]
},
{
"odata.type": "Microsoft.Azure.Management.Insights.Models.RuleWebhookAction",
"serviceUri": "[parameters('webhookUrl')]",
"properties": { }
}
]
}
}
For more information about conditions and actions, see Delete an alert rule.