Question

我尝试为 webhook 设置应用程序洞察警报（准确地说是 MS Teams）。我已经成功地创建了警报，并且数据已经发送到 webhook 并显示在 Teams 中。

这是一个日志警报。

我现在缺少的是该日志警报的查询结果。文档 [https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log-webhook#log-alert-with-a-custom-json-payload] 只是说明我需要在负载中添加一个简单的配置参数：

"IncludeSearchResults":true

我所做的。但是仍然看不到包含查询结果的 Json-Attachment（或其他任何东西）。我的完整有效负载（除了结果部分之外工作正常）如下所示：

{   
    "@context": "http://schema.org/extensions",
    "@type": "MessageCard",
    "IncludeSearchResults":true,
    "themeColor": "CC4216",
    "title": "#alertrulename",
    "text": "#alertrulename returned #searchresultcount records which exceeds the threshold of #thresholdvalue .",
    "summary": "Query: #searchquery",

    "potentialAction": [{
        "@type": "OpenUri",
        "name": "See details in AppInsights",
        "targets": [{
            "os": "default",
            "uri": "#linktosearchresults"
        }]
    }],
    "sections": [{
        "facts": [{
            "name": "Severity:",
            "value": "#severity"
        },
        {
            "name": "Query:",
            "value": "#searchquery"
        },
        {
            "name": "ResultCount:",
            "value": "#searchresultcount"
        },
        {
            "name": "Search Interval StartTime:",
            "value": "#searchintervalstarttimeutc"
        },
        {
            "name": "Search Interval End time:",
            "value": "#searchintervalendtimeutc"
        },
        {
            "name": "AppInsights Application ID:",
            "value": "#applicationid"
        }]
    }]
}

我想要实现的是，自动添加到任何电子邮件通知的“前 10 个结果”也显示在 Teams 中：

Answer 1

O365 连接器卡架构不包含 IncludeSearchResults 属性。您需要获取结果，然后将数据绑定到卡。你能获取结果吗？

在 Webhook 的应用程序洞察警报中包含查询结果

1 个答案: