Azure ARM 无法解析 |字符

Question

我在尝试部署自定义日志警报时遇到了 ARM 模板无法解析我尝试传递的查询的问题。

错误：

谁能告诉我如何避免这种情况？我试图转义字符，将其硬编码到模板中，但这似乎不起作用。

这是我正在使用的模板资源：

{
            "type": "Microsoft.Insights/scheduledQueryRules",
            "name": "Sample log query alert",
            "apiVersion": "2018-04-16",
            "location": "global",
            "properties": {
                "description": "[parameters('alertDescription')]",
                "enabled": "[parameters('isEnabled')]",
                "source": {
                    "query": "requests | project timestamp, operation_Name, success, cloud_RoleName | where timestamp > ago(5m) | where cloud_RoleName =~ 'appName' and operation_Name =~ 'functionName' and success == false",
                    "dataSourceId": "[resourceId('Microsoft.insights/components',parameters('applicationInsightsName'))]",
                    "queryType": "ResultCount"
                },
                "schedule": {
                    "frequencyInMinutes": 1,
                    "timeWindowInMinutes": 5
                },
                "action": {
                    "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction",
                    "severity": "[parameters('alertSeverity')]",
                    "aznsAction": {
                        "actionGroup": [
                          "[resourceId('Microsoft.Insights/actionGroups',parameters('actionGroupName'))]"
                        ]
                    }
                },
                "trigger": {
                    "thresholdOperator": "GreaterThan",
                    "threshold": 0
                }
            }
        }

这是我尝试使用的查询：

requests | project timestamp, operation_Name, success, cloud_RoleName | where timestamp > ago(5m) | where cloud_RoleName =~ 'appName' and operation_Name =~ 'functionName' and success == false

参考： https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-log#create-a-log-alert-rule-with-the-azure-portal

https://devblogs.microsoft.com/premier-developer/alerts-based-on-analytics-query-using-custom-log-search/

Answer 1

对于字符|，请确保它是英文字符，并在模板中硬编码。

我在身边测试过，没问题。这是我的 template.json:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "scheduledqueryrules_my_test_222_name": {
            "defaultValue": "my test 33300",
            "type": "String"
        },
        "components_yyinsights333_externalid": {
            "defaultValue": "/subscriptions/xxxxx/resourceGroups/xxxxx/providers/microsoft.insights/components/yyinsights333",
            "type": "String"
        },
        "actiongroups_yyactiongroup11_externalid": {
            "defaultValue": "/subscriptions/xxxx/resourceGroups/xxxx/providers/microsoft.insights/actiongroups/yyactiongroup11",
            "type": "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "microsoft.insights/scheduledqueryrules",
            "apiVersion": "2018-04-16",
            "name": "[parameters('scheduledqueryrules_my_test_222_name')]",
            "location": "westus2",
            "properties": {
                "enabled": "true",
                "source": {
                    "query": "requests | project timestamp, operation_Name, success, cloud_RoleName | where timestamp > ago(5m) | where cloud_RoleName =~ 'appName' and operation_Name =~ 'functionName' and success == false",
                    "authorizedResources": [],
                    "dataSourceId": "[parameters('components_yyinsights333_externalid')]",
                    "queryType": "ResultCount"
                },
                "schedule": {
                    "frequencyInMinutes": 5,
                    "timeWindowInMinutes": 5
                },
                "action": {
                    "severity": "3",
                    "aznsAction": {
                        "actionGroup": [
                            "[parameters('actiongroups_yyactiongroup11_externalid')]"
                        ]
                    },
                    "trigger": {
                        "thresholdOperator": "GreaterThan",
                        "threshold": 20
                    },
                    "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction"
                }
            }
        }
    ]
}

这里是 parameters.json:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
      "scheduledqueryrules_my_test_222_name": {
        "value": "my test 33300"
      },
      "components_yyinsights333_externalid": {
        "value": "/subscriptions/xxx/resourceGroups/xxx/providers/microsoft.insights/components/yyinsights333"
      },
      "actiongroups_yyactiongroup11_externalid": {
        "value": "/subscriptions/xxx/resourceGroups/xxx/providers/microsoft.insights/actiongroups/yyactiongroup11"
      }
    }
}

使用 powershell 部署：

请尝试 copy-paste 我的 .json 文件，如果您有更多问题，请告诉我。

另一种解决方案是，您可以先通过UI在azure portal中手动创建此警报，创建后，导航至此警报规则->并复制azure生成的模板文件->然后使用正确的 json 文件部署警报。这是如何检查自动生成的模板的屏幕截图：

Azure ARM 无法解析 |字符

Azure ARM cannot parse | char

azure

azure-resource-manager

azure-template