scheduledlogquery-alert.json

{
  "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "alertEmailAddress": {
      "type": "string",
      "metadata": {
        "description": "The email address to receive any alerts."
      }
    },
    "applicationInsightsLocation": {
      "type": "string",
      "defaultValue": "westus2",
      "allowedValues": [
        "eastus",
        "southcentralus",
        "westus2",
        "northeurope",
        "westeurope",
        "southeastasia"
      ],
      "metadata": {
        "description": "The location in which to deploy Application Insights, since it supports a subset of Azure regions."
      }
    }
  },
  "variables": {
    "applicationInsightsName": "AppInsights",
    "actionGroupName": "MyApplicationWarnings"
  },
  "resources": [
    {
      "name": "[variables('applicationInsightsName')]",
      "type": "Microsoft.Insights/components",
      "location": "[parameters('applicationInsightsLocation')]",
      "apiVersion": "2014-04-01",
      "kind": "other",
      "properties": {
        "applicationId": "[variables('applicationInsightsName')]"
      }
    },
    {
      "name": "[variables('actionGroupName')]",
      "type": "Microsoft.Insights/actionGroups",
      "location": "global",
      "apiVersion": "2018-03-01",
      "properties": {
        "groupShortName": "App Service",
        "enabled": true,
        "emailReceivers": [
          {
            "name": "Account Owner",
            "emailAddress": "[parameters('alertEmailAddress')]"
          }
        ]
      }
    },
    {
      "name": "WcfExceptions",
      "type": "Microsoft.Insights/scheduledQueryRules",
      "location": "[parameters('applicationInsightsLocation')]",
      "apiVersion": "2018-04-16",
      "tags": {
        "[concat('hidden-link:', resourceId('Microsoft.Insights/components', variables('applicationInsightsName')))]": "Resource"
      },
      "properties": {
        "description": "Exceptions from the WCF Library",
        "enabled": "true",
        "source": {
          "query": "exceptions | where type matches regex 'System.ServiceModel.*'",
          "dataSourceId": "[resourceId('Microsoft.Insights/components', variables('applicationInsightsName'))]",
          "queryType": "ResultCount",
          "authorizedResources": [
            "[resourceId('Microsoft.Insights/components', variables('applicationInsightsName'))]"
          ]
        },
        "schedule": {
          "frequencyInMinutes": 5,
          "timeWindowInMinutes": 5
        },
        "action": {
          "severity": "3",
          "aznsAction": {
            "actionGroup": [
              "[resourceId('Microsoft.Insights/actionGroups', variables('actionGroupName'))]"
            ]
          },
          "trigger": {
            "thresholdOperator": "GreaterThan",
            "threshold": 0
          },
          "odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Insights/actionGroups', variables('actionGroupName'))]",
        "[resourceId('Microsoft.Insights/components', variables('applicationInsightsName'))]"
      ]
    }
  ]
}