kql - 搜索查询应包含度量警报类型的“AggregatedValue”和“bin(TimeGenerated, [roundTo])”
问题描述
我想在以下情况下创建警报:
if (incoming_messages of event hub != outgoing_messages of event hub)
then I should get alerted
为此,我在日志分析中创建了一个查询,其中“比较”列显示事件中心的传入和传出消息的差异
但是当我使用以下查询作为“度量测量”来创建警报时.....它给出了以下错误
搜索查询应包含度量警报类型的“AggregatedValue”和“bin(TimeGenerated, [roundTo])”
有人可以告诉我如何解决这个错误,或者有没有其他方法可以为上述场景设置警报?
这是查询
let Incoming_Messages = AzureMetrics
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where _ResourceId contains "ResourceID-Hidden"
| where TimeGenerated > ago(1h)
| where MetricName contains "IncomingMessages"
| count | extend CommonCol="Dummy"
| project CommonCol, TotalIncomingMessages = Count;
let Outgoing_Messages = AzureMetrics
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where _ResourceId contains "ResourceID-Hidden"
| where TimeGenerated > ago(1h)
| where MetricName contains "OutgoingMessages"
| count | extend CommonCol="Dummy"
| project CommonCol, TotalOutgoingMessages = Count;
Incoming_Messages
| join Outgoing_Messages on CommonCol
| extend Comparison = TotalIncomingMessages - TotalOutgoingMessages
| project TotalOutgoingMessages, TotalIncomingMessages, Comparison
错误截图:
解决方案
在您的情况下,使用“结果数量”似乎更有意义。由于您想知道是否有任何行符合条件。
使用“结果数”(阈值 > 0)尝试此查询:
let Incoming_Messages = AzureMetrics
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where _ResourceId contains "ResourceID-Hidden"
| where TimeGenerated > ago(1h)
| where MetricName contains "IncomingMessages"
| count | extend CommonCol="Dummy"
| project CommonCol, TotalIncomingMessages = Count;
let Outgoing_Messages = AzureMetrics
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where _ResourceId contains "ResourceID-Hidden"
| where TimeGenerated > ago(1h)
| where MetricName contains "OutgoingMessages"
| count | extend CommonCol="Dummy"
| project CommonCol, TotalOutgoingMessages = Count;
Incoming_Messages
| join Outgoing_Messages on CommonCol
| extend Comparison = TotalIncomingMessages - TotalOutgoingMessages
| project TotalOutgoingMessages, TotalIncomingMessages, Comparison
| where Comparison != 0
推荐阅读
- c# - 为什么我的 DefaultHttpContext 会话配置在(约 20 分钟)后失效?
- javascript - 防止 window.open() 刷新窗口
- ios - AVAudioPlayer 支持的音频文件格式?
- sql - 如何更改表格的布局/结构?
- python - 向网络图添加边时出错:清理列表条目的“v_of_edge”
- android - 播放几个小时后应用程序冻结
- python-3.x - TensorFlow Checkpoint 恢复学习率
- google-analytics - 谷歌分析不显示数值
- maven - Maven 插件 maven-antrun-plugin 复制选项不会覆盖
- python - 从 python 文件而不是从命令行运行 pytest 测试