Easy way to exclude a resource from a Log analytics query alert?

Occasional Contributor

If I have a query setup that checks high CPU from all VMs reporting to that log analytics workspace and i want to suppress one or two VMs for a while since i'm doing some operations to them. I know i can edit the query but would be nice if i could suppress or edit on the go to exclude a few resources.

5 Replies
best response confirmed by Juval (Occasional Contributor)

@Juval you can do action rules. or you can use dimensions in the alert to only select resources you want.

Hi, ok so instead of messing with the original alert and adding basically a exemption list i could do a value or a list in the payload filter and suppress it that way. I like this cause this way i can see if i forgot it on or if i just need it to be suppressed for half a day. Awesome! Thanks!

Hi! But i guess in that scenario i would need a new Action rules? I'm thinking if i already have alerts defined through a log analytics workspace and then i'm having a few misbehaving resources i would like to suppress the alerts from just those resources. If i understood @pvyver right, i could just suppress those and see those values later what i did and even schedule it. I believe this is what i need.
Yes, add a new Action Rule, scope to the workspace and specify the computer name in the payload.
Specify the schedule, and you are good to go.