Forum Discussion
Azure Alert - Custom JSON payload with log search alert
Hi,
For metric alerts, you get active or deactivate alerts, as there is a very clear threshold and they are stateful. For log and event-based alerts, it works a bit differently.
Stateful alerts fire once per incident and resolve. The alert rule resolves when the alert condition isn't met for 30 minutes for a specific evaluation period (to account for log ingestion delay), and for three consecutive evaluations to reduce noise if there is flapping conditions. For example, with a frequency of 5 minutes, the alert resolve after 40 minutes or with a frequency of 1 minute, the alert resolve after 32 minutes. The resolved notification is sent out via web-hooks or email, the status of the alert instance (called monitor state) in Azure portal is also set to resolved.
Stateful alerts feature is currently in preview in the Azure public cloud. You can set this using Automatically resolve alerts in the alert details section.
Source: Log alerts in Azure Monitor - Azure Monitor | Microsoft Docs
yes correct that the alert goes in active or deactivate. I already enabled "automatically resolve alerts".
The problem is that into log search alert i miss activated or deactivated status into payload and i would like to add it becouse we need to check the status when a script into automation call on duty technician. Without status script call twice when log search alert fire and when log search alert resolve.
I did a workaround but i would like to add it into payload.