Question

我正在尝试创建一个包含通过ARM模板附加警报的oms工作空间。我已经创建了OMS工作区，并在警报部分中遵循以下tutorial。经过一番挣扎之后，为什么我的警报无法部署，我在以下注释中看到了同一教程的命令。

“操作”方案已更改，此外警报已在Azure监视器中：）这是link。

当我尝试阅读文档并变得更聪明时，我陷入了无休止的参考链接循环：

本教程中提供的链接说Beginning May 14, 2018, all alerts in an Azure public cloud instance of Log Analytics workspace began to extend into Azure.一段时间后我发现跟随link。我以为我终于找到了如何解释新警报的地方。但这是为了获得应用程序见解，而非日志分析。

关于我的问题：有没有人可以帮助我找到新的Alert方案的工作方式或尝试向正确的方向提供指导。

Answer 1

我不是OMS专家，但这就是我们一直在使用的东西：

class MydAdapter (val mListMy:List<YourDatamodel> = listOf() ) : RecyclerView.Adapter<MydAdapter.MyViewHolder>()
// rest of your code

这是一个示例保存的搜索变量，我们将其用于映射所有内容：

{
    "apiVersion": "2017-03-15-preview",
    "name": "[concat(variables('namespace'), '/', variables('savedSearches').Search[copyIndex()].Name)]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
    "copy": {
        "name": "SavedSearchCopy",
        "count": "[length(variables('savedSearches').Search)]"
    },
    "dependsOn": [
        "[concat('Microsoft.OperationalInsights/workspaces/', variables('namespace'))]",
        "ActionGroupCopy"
    ],
    "properties": {
        "category": "Alerts",
        "displayName": "[variables('savedSearches').Search[copyIndex()].DisplayName]",
        "query": "[variables('savedSearches').Search[copyIndex()].Query]"
    }
},
{
    "name": "[tolower(concat(variables('namespace'), '/', variables('savedSearches').Search[copyIndex()].Name, '/',  variables('savedSearches').Search[copyIndex()].Schedule.Name))]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches/schedules/",
    "apiVersion": "2017-03-03-preview",
    "copy": {
        "name": "ScheduleCopy",
        "count": "[length(variables('savedSearches').Search)]"
    },
    "dependsOn": [
        "SavedSearchCopy"
    ],
    "properties": {
        "interval": "5",
        "queryTimeSpan": "10",
        "enabled": true
    }
},
{
    "name": "[tolower(concat(variables('namespace'), '/', variables('savedSearches').Search[copyIndex()].Name, '/',  variables('savedSearches').Search[copyIndex()].Schedule.Name, '/', variables('savedSearches').Search[copyIndex()].Alert.Name, '-', if(contains(variables('savedSearches').Search[copyIndex()].Alert, 'MetricsTrigger'), 'Total', 'Consecutive')))]",
    "type": "Microsoft.OperationalInsights/workspaces/savedSearches/schedules/actions",
    "copy": {
        "name": "ActionCopy",
        "count": "[length(variables('savedSearches').Search)]"
    },
    "apiVersion": "2017-03-15-preview",
    "dependsOn": [
        "SavedSearchCopy"
    ],
    "properties": {
        "Type": "Alert",
        "Name": "[variables('savedSearches').Search[copyIndex()].Alert.Name]",
        "Description": "[variables('savedSearches').Search[copyIndex()].Alert.Description]",
        "Severity": "warning",
        "Threshold": "[variables('savedSearches').Search[copyIndex()].Alert.Threshold]",
        "Throttling": {
            "DurationInMinutes": 60
        },
        "AzNsNotification": {
            "GroupIds": [
                "[resourceId('microsoft.insights/actionGroups', 'xxx')]"
            ]
        }
    }
},
{
    "type": "Microsoft.Insights/actionGroups",
    "apiVersion": "2018-03-01",
    "name": "[variables('actionGroups')[copyIndex()].Name]",
    "copy": {
        "name": "ActionGroupCopy",
        "count": "[length(variables('actionGroups'))]"
    },
    "location": "Global",
    "properties": {
        "groupShortName": "[variables('actionGroups')[copyIndex()].Name]",
        "enabled": true,
        "emailReceivers": [
            {
                "name": "[variables('actionGroups')[copyIndex()].EmailName]",
                "emailAddress": "[variables('actionGroups')[copyIndex()].EmailAddress]"
            }
        ]
    }
},

是否有ARM模板解决方案可为日志分析创建OMS警报

1 个答案: