Create or update an alert rule in Azure Monitor REST API

 

Updated: September 26, 2016

See Common headers and parameters for headers and parameters that are used by all requests related to alerts.

Method

Request URI

PUT

https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/microsoft.insights/alertRules/{alert-rule-name}?api-version={api-version}

Replace {alert-rule-name} with the name of the alert rule for which you want to create or update.


{
  "location": "eastus",
  "tags": { },
  "properties": {
    "name": "CPUHigh Plan",
    "description": "The average CPU is high across all the instances of Plan",
    "isEnabled": true,
    "condition": {
      "odata.type": "Microsoft.Azure.Management.Insights.Models.ThresholdRuleCondition",
      "dataSource": {
        "odata.type": "Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource",
        "resourceUri": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/Default-Storage-NorthCentralUS/providers/Microsoft.Web/serverfarms/Plan",
        "metricName": "CpuPercentage",
        "operator": "GreaterThan"
      },
      "threshold": 90,
      "windowSize": "PT15M",
      "timeAggregation": "Average"
    },
    "actions": [
      {
        "odata.type": "Microsoft.Azure.Management.Insights.Models.RuleEmailAction",
        "sendToServiceOwners": true,
        "customEmails": ["email1@contoso.com","email2@contoso.com" ]
      },
      {
        "odata.type": "Microsoft.Azure.Management.Insights.Models.RuleWebhookAction",
        "serviceUri": "http://contoso.com/",
        "properties": { }
      }
    ]
  }
}

Element Name

Required

Type

Description

location

Yes

String

Specifies the supported Azure location of the alert rule. For more information, see List all of the available geo-locations.

tags

No

Complex Type

The tags and their values that are used by the alert rule.

name

Yes

String

The name of the alert rule.

description

Yes

String

Description of the alert rule that will be included in the alert email.

isEnabled

Yes

Boolean

Indicates whether the alert rule is enabled.

condition

Yes

Complex Type

The condition that results in the alert rule being activated.

actions

Yes

Complex Type

Array of actions that are performed when the alert rule becomes active, and when an alert condition is resolved.

The condition can vary depending on its type. There are currently 3 types of conditions. The first is based on the threshold for a metric you define:

Element Name

Description

odata.type

Always Microsoft.Azure.Management.Insights.Models.ThresholdRuleCondition

dataSource

Always Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource

resourceUri

The resource identifier of the resource the rule monitors.

metricName

The name of the metric that defines what the rule monitors.

operator

The operator used to compare the data and the threshold.

threshold

The threshold value that activates the alert.

windowSize

The period of time that is used to monitor alert activity based on the threshold. Must be between 5 minutes and 1 day. ISO 8601 duration format.

timeAggregation

How the data that is collected should be combined over time. The default value is Average.

The second is based on the number of failures that a web test has:

{
  "odata.type": "Microsoft.Azure.Management.Insights.Models.LocationThresholdRuleCondition",
  "dataSource": {
    "odata.type": "Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource",
    "resourceUri": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourcegroups/Default-Web-CentralUS/providers/microsoft.insights/webtests/homepagetest-newrelapp2",
    "metricName": "GSMT_AvRaW"
  },
  "windowSize": "PT5M",
  "failedLocationCount": 1
}

Element Name

Description

odata.type

Always Microsoft.Azure.Management.Insights.Models.LocationThresholdRuleCondition

dataSource

Always Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource

resourceUri

The resource identifier of the resource the rule monitors.

metricName

The name of the metric that defines what the rule monitors.

failedLocationCount

The number of locations that must fail to activate the alert.

windowSize

The period of time that is used to monitor alert activity based on the threshold. Must be between 5 minutes and 1 day. ISO 8601 duration format.

The third is on the occurrences of management events:

{
  "odata.type": "Microsoft.Azure.Management.Insights.Models.ManagementEventRuleCondition",
  "dataSource": {
    "odata.type": "Microsoft.Azure.Management.Insights.Models.RuleManagementEventDataSource",
    "operationName": "",
    "resourceUri": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/Default-Web-CentralUS/providers/Microsoft.Web/sites/TestLatestWebsite",
    "status": "failed",
    "claims": { }
  },
  "aggregation": {
    "threshold": 1,
    "windowSize": "PT5M"
  }
}

Element Name

Description

odata.type

Always Microsoft.Azure.Management.Insights.Models.ManagementEventRuleCondition

dataSource

Always Microsoft.Azure.Management.Insights.Models.RuleManagementEventDataSource

operationName

The name of the operation that should be checked for. If no name is provided, any operation will match.

resourceUri

The resource identifier of the resource the rule monitors.

status

The status of the operation that should be checked for. If no status is provided, any status will match.

claims

The status of the operation that should be checked for. If no status is provided, any status will match.

aggregation

How the data that is collected should be combined over time. Note that for management event alerts aggregation is optional – if it is not provided then any event will cause the alert to activate.

threshold

The threshold value that activates the alert.

windowSize

The period of time that is used to monitor alert activity based on the threshold. Must be between 5 minutes and 1 day. ISO 8601 duration format.

Finally, the action is what should happen when the condition is met. There are two types of possible actions that occur when the alert is activated or resolved. First is to send email.

Element Name

Description

odata.type

Always Microsoft.Azure.Management.Insights.Models.RuleEmailAction

sendToServiceOwners

Whether the administrators (service and co-administrators) of the service should be notified when the alert is activated.

customEmails

A list of administrator's custom email addresses notify of the activation of the alert.

The second is to call a webhook.

Element Name

Description

odata.type

Always Microsoft.Azure.Management.Insights.Models.RuleWebhookAction

serviceUri

The URI called when the alert activates or resolves.

properties

A list of custom JSON properties to append to the webhook payload.

Status code: 200.

{
  "id": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/Default-Web-NorthCentralUS/providers/microsoft.insights/alertrules/CPUHigh%20Plan",
  "location": "eastus",
  "tags": { },
  "properties": {
    "name": "CPUHigh Plan",
    "description": "The average CPU is high across all the instances of Plan",
    "isEnabled": true,
    "condition": {
      "odata.type": "Microsoft.Azure.Management.Insights.Models.ThresholdRuleCondition",
      "dataSource": {
        "odata.type": "Microsoft.Azure.Management.Insights.Models.RuleMetricDataSource",
        "resourceUri": "/subscriptions/089bd33f-d4ec-47fe-8ba5-0753aa5c5b33/resourceGroups/Default-Storage-NorthCentralUS/providers/Microsoft.Web/serverfarms/Plan",
        "metricName": "CpuPercentage",
        "operator": "GreaterThan"
      },
      "threshold": 90,
      "windowSize": "PT15M",
      "timeAggregation": "Average"
    },
    "actions": [
      {
        "odata.type": "Microsoft.Azure.Management.Insights.Models.RuleEmailAction",
        "sendToServiceOwners": true,
        "customEmails": [ ]
      },
      {
        "odata.type": "Microsoft.Azure.Management.Insights.Models.RuleWebhookAction",
        "serviceUri": "[parameters('webhookUrl')]",
        "properties": { }
      }
    ]
  }
}

For more information about conditions and actions, see Delete an alert rule.

Show: