6

I have created Azure Log Analytics (Monitor) Alert to monitor the Logic App Failures and I have done this using Azure portal. I would like to know how can we export the Alert created from Azure Portal as an ARM template? Anyone know how we can achieve it.

Thanks enter image description here

enter image description here

user42012
  • 722
  • 12
  • 33

2 Answers2

15

If you want to export the ARM template of the alert in the portal, please follow the steps below.

1.In the portal, navigate to the resource group which the alert located in(Note: It is the group of the alert, not the group of the alert's target resource), select the Show hidden types option -> find your alert and select it -> click Export Template.

enter image description here

2.Click the Download like below, then it will download the template as a compressed file which includes the template.json and parameters.json to local.

enter image description here

Update:

What you are using is legacy Log Analytics Alert, from June 1, 2019, it automatically use new scheduledQueryRules by default in Azure portal, its resource type is microsoft.insights/scheduledqueryrules.

In your case, you could follow this link to switch from the old alert to new one.

Or create a new alert in the portal, navigate to the Log Analytics workspace in the portal -> New alert rule -> Add Custom log search and create it.

enter image description here

Ater create it, in the resource group, select the Show hidden types option, you will find the alert like below, then you can export the template.

enter image description here

Joy Wang
  • 39,905
  • 3
  • 30
  • 54
  • Thank you Joy, I gave it a try but this does not still show me My Alert that I created in Log Analytics (I ensured I selected SHOW HIDDEN and also selected resource group of the Alert not the Target resource). Not sure if this method works for Log analytics alerts I can see Application Insights Alerts though. – user42012 Apr 03 '20 at 13:26
  • @user42012 Please show the screenshot of your alert in the portal. – Joy Wang Apr 03 '20 at 13:53
  • hi @Joy Wang I have updated my original post with the screenshot, both of the Alert and of the Resource group. – user42012 Apr 03 '20 at 14:02
  • @user42012 I will look into it later. – Joy Wang Apr 03 '20 at 15:19
  • No worries, Thank you @Joy-wang , basically I created a Alert from Log Analytics workspace using a CUSTOM LOG SEARCH criteria (query) and it shows as ResourceType (Microsoft.OperationalInsights). – user42012 Apr 03 '20 at 15:44
  • Thank you @Joy-wang this helps. – user42012 Apr 07 '20 at 20:40
0

You are using the legacy log analytics API and this doesn't support export for templates as they are not ARM tracked resources. The definition for those would be on the workspace itself (under savedsearch => schedule => action). If you want to be able to export more easily, please consider using the newer ScheduledQueryRules API. Learn more on how to switch here: https://learn.microsoft.com/azure/azure-monitor/platform/alerts-log-api-switch#process-of-switching-from-legacy-log-alerts-api

Please note this could be a big change due to API change, please review the complete article to understand what will happen after the switch.

Yaniv Lavi
  • 41
  • 3