Sample Azure SDK for Go & Autorest-Go (Get alert info in Log Analytics saved search)

main.go

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"log"
	"net/http"

	"github.com/Azure/azure-sdk-for-go/services/operationalinsights/mgmt/2015-03-20/operationalinsights"
	"github.com/Azure/go-autorest/autorest"
	"github.com/Azure/go-autorest/autorest/azure/auth"
)

const (
	resourceGroupURLTemplate = "https://management.azure.com/"
	subscriptionID           = "Your Subscription ID"
	//don't need purgeID for this purpose
	purgeID           = ""
	resourceGroupName = "Your Resource Group of Log Analytics Workspace"
	workSpaceName     = "Your Log Analytice Workspace"
)

var (
	ctx        = context.Background()
	authorizer autorest.Authorizer
)

//SavedSearchSchedule struct
type SavedSearchSchedule struct {
	ID         string `json:"id"`
	Etag       string `json:"etag"`
	Properties struct {
		Interval      int `json:"interval"`
		QueryTimeSpan int `json:"querytimespan"`
	} `json:"properties"`
}

//SavedSearchAction struct
type SavedSearchAction struct {
	Etag       string `json:"etag"`
	Properties struct {
		Type      string `json:"type"`
		Name      string `json:"name"`
		Threshold struct {
			Operator string `json:"operator"`
			Value    int    `json:"value"`
		} `json:"threshold"`
		Severity string `json:"severity"`
		Verison  int    `json:"version"`
	} `json:"properties"`
}

func getSavedSearchScheduleID(client *autorest.Client, searchID string) (ids []SavedSearchSchedule, err error) {
	apiVersion := "2015-03-20"
	q := map[string]interface{}{"api-version": apiVersion}

	req, _ := autorest.Prepare(&http.Request{},
		autorest.AsGet(),
		autorest.WithBaseURL(resourceGroupURLTemplate),
		autorest.WithPath(searchID),
		autorest.WithPath("/schedules"),
		autorest.WithQueryParameters(q))

	resp, err := autorest.SendWithSender(client, req)
	if err != nil {
		return
	}

	value := struct {
		SSS []SavedSearchSchedule `json:"value"`
	}{}

	defer resp.Body.Close()
	dec := json.NewDecoder(resp.Body)
	err = dec.Decode(&value)
	if err != nil {
		return
	}

	if len(value.SSS) != 0 {
		ids = make([]SavedSearchSchedule, len(value.SSS))

		for i, ss := range value.SSS {
			ids[i] = ss
		}
	}

	return
}

func getSavedSearchAction(client *autorest.Client, scheduleID string) (actions []SavedSearchAction, err error) {
	apiVersion := "2015-03-20"
	q := map[string]interface{}{"api-version": apiVersion}

	req, _ := autorest.Prepare(&http.Request{},
		autorest.AsGet(),
		autorest.WithBaseURL(resourceGroupURLTemplate),
		autorest.WithPath(scheduleID),
		autorest.WithPath("/actions"),
		autorest.WithQueryParameters(q))

	resp, err := autorest.SendWithSender(client, req)
	if err != nil {
		return
	}

	value := struct {
		SSA []SavedSearchAction `json:"value"`
	}{}

	defer resp.Body.Close()
	dec := json.NewDecoder(resp.Body)
	err = dec.Decode(&value)
	if err != nil {
		return
	}

	if len(value.SSA) != 0 {
		actions = make([]SavedSearchAction, len(value.SSA))

		for i, sa := range value.SSA {
			actions[i] = sa
		}
	}

	return
}

func main() {
	savedSearchesClient := operationalinsights.NewSavedSearchesClient(subscriptionID, purgeID)
	authorizer, err := auth.NewAuthorizerFromEnvironment()
	if err == nil {
		savedSearchesClient.Authorizer = authorizer
	}

	searches, err := savedSearchesClient.ListByWorkspace(ctx, resourceGroupName, workSpaceName)
	if err != nil {
		log.Fatalf("Failed to get saved searches : %v", err)
	}

	for _, search := range *searches.Value {
		client := &autorest.Client{}
		client.Authorizer = authorizer

		scheduleIDs, err := getSavedSearchScheduleID(client, *search.ID)
		if err != nil {
			log.Fatalf("Failed to get saved search schedule ID : %v", err)
		}

		for _, id := range scheduleIDs {
			actions, err := getSavedSearchAction(client, id.ID)
			if err != nil {
				log.Fatalf("Failed to get saved search action : %v", err)
			}
			for _, action := range actions {
				fmt.Printf("[Type] Log Analytics Saved Serach [Name] %v [Query]  %v\n", action.Properties.Name, *(*search.SavedSearchProperties).Query)
			}
		}

	}
}