Dimensions in webhook payload

Question

Hi Azure Monitor team!Recent blog update from 24 June mentions dimensions in fired alerts now showing better what was affected. When using common alert schema, it appears I'm starting to consistently see the actual affected device from a searchquery result in AffectedConfigurationItems. Is AffectedConfigurationItems the "best" place searchresults always will be placed in? I'm asking so that I know what part of the json webhook payload I need to go through to see what device the alert is for.

michael_milirud · Answer

-Akos-&nbsp;standard schema definition is service specific. Here are samples for each of the services.&nbsp;https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-common-schema-definitions. Please let us know if this doesn't answer your question.Best,&nbsp; Michael-Azure Monitor Product Management

-akos- · Answer

Michael_Milirud&nbsp; I've had that page sort of like a bible bookmarked and read it a number of times, but no, it doesn't say everything I need to know. With a Log Analytics query based alert, I would like to know if the AffectedConfigurationItems section will always hold the data of affected servers. I've noticed a few times that section in the json was empty, but there was data in the search results table.&nbsp;btw, I mentioned a blog, this one was it.&nbsp;Also, Log analytics links to the portal are supposed to be compressed, but I'm still seeing very long links in the json data.

michael_milirud · Answer

-Akos-&nbsp;I've reached out to our alerting team to get an answer for you on this. If you are still seeing uncompressed links we should take a look at your repro. Can you share a sample JSON that you are seeing with issues highlighted?Best,&nbsp; Michael

-akos- · Answer

Michael_Milirud&nbsp;I will send you a message offline with some json data. I may need to redact some sensitive data, but the data will be intact otherwise

yalavi · Answer

-Akos-&nbsp;The post was about the new 'Dimensions' section in the payload for metric measure log alert type that you control, that split the alerts and provide the context of the fired alerts.
AffectedConfigurationItems is an old and only partly reliable feature that uses&nbsp;heuristics of column names.&nbsp;&nbsp;Future API version will not have&nbsp;AffectedConfigurationItems, but will make it easier to define dimensions even for simple count of rows.
&nbsp;
There is an example here (and in the common schema definition page you have):
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-log-webhook#log-alert-for-log-analytics

Forum Discussion

Dimensions in webhook payload

Share

Resources