We’re excited to announce the General Availability of dynamic thresholds for log search alerts in Azure Monitor. Dynamic thresholds make anomaly detection easier by using machine learning to learn normal behavior from your historical log query results, automatically account for patterns such as hourly, daily, and weekly seasonality, and adapt as your environment changes. Instead of manually choosing static limits that can quickly become outdated, you can let Azure Monitor automatically determine the right threshold for each alert rule. Dynamic thresholds for Log search alerts are available at no extra charge - you pay the standard log search alert rule rate.
Dynamic threshold preview chart displayed when setting up a new alert rule.Why it matters
- Simplified configuration: No need to fine-tune thresholds manually.
- Adaptive monitoring: Alerts automatically adapt to changing usage patterns and trends.
- At-scale intelligence: For multi-dimensional monitoring, thresholds are calculated per dimension combination.
Example use cases
AKS Pod restart spike anomaly detection
- Scenario: Monitor Kubernetes Pod logs for spikes in pod restarts across clusters.
- Why dynamic thresholds help:
- AKS workloads often scale dynamically; static thresholds can’t account for autoscaling patterns.
- Dynamic thresholds adapt to normal fluctuations in node/pod counts and alert only on true anomalies.
- Example query:
KubePodInventory | summarize restartCount = sum(PodRestartCount) by bin(TimeGenerated, 10m), ClusterName, Namespace, Name- Dynamic threshold settings:
- Namespace (for workload-level baselines).
- Name (for per-pod granularity if needed).
- Measure: restartCount (the aggregated column from the query).
- Split by dimensions (optional):
- Namespace (for workload-level baselines).
- Name (for per-pod granularity if needed).
Resource Inventory Drift Detection (Azure Resource Graph)
- Scenario: Detect sudden spikes in resource creation or deletion across subscriptions or management groups utilizing Log search alerts integration with Azure Resource Graph that may indicate runaway deployments.
- Why dynamic thresholds help:
- Large organizations often have thousands of resources with varying deployment patterns.
- Static thresholds can’t account for seasonal changes (e.g., monthly deployments, scaling events).
- Dynamic thresholds adapt per subscription or resource type, reducing false positives.
- Example query:
arg("").Resources | summarize resourceCount = count() by type, subscriptionId- Dynamic threshold settings:
- type (for specific resource type changes).
- subscriptionId (for per-subscription granularity).
- Measure: resourceCount (the aggregated column from the query).
- Split by dimensions (optional):
- type (for specific resource type changes).
- subscriptionId (for per-subscription granularity).
Getting Started
Microsoft