swagger: '2.0' info: version: 2020-08-01-preview title: Microsoft Azure AccessControlClient AccessConnector scheduledQueryRules API schemes: - https tags: - name: scheduledQueryRules paths: ? /subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Insights/scheduledQueryRules/{ruleName} : put: description: Creates or updates an log search rule. tags: - scheduledQueryRules operationId: microsoftAzureScheduledqueryrulesCreateorupdate parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: '#/parameters/RuleNameParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter - name: parameters in: body required: true schema: $ref: '#/definitions/LogSearchRuleResource' description: The parameters of the rule to create or update. responses: '200': description: Successful request to update an Log Search rule schema: $ref: '#/definitions/LogSearchRuleResource' '201': description: Created alert rule schema: $ref: '#/definitions/LogSearchRuleResource' default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract' x-ms-examples: Create or Update rule - AlertingAction: $ref: ./examples/createOrUpdateScheduledQueryRules.json Create or Update rule - AlertingAction with Cross-Resource: $ref: ./examples/createOrUpdateScheduledQueryRuleswithCrossResource.json Create or Update rule - LogToMetricAction: $ref: ./examples/createOrUpdateScheduledQueryRule-LogToMetricAction.json summary: Microsoft Azure Put Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules Rulename get: description: Gets an Log Search rule tags: - scheduledQueryRules operationId: microsoftAzureScheduledqueryrulesGet parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: '#/parameters/RuleNameParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter responses: '200': description: Successful request to get a Log Search rule schema: $ref: '#/definitions/LogSearchRuleResource' default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract' x-ms-examples: Get rule: $ref: ./examples/getScheduledQueryRules.json summary: Microsoft Azure Get Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules Rulename patch: tags: - scheduledQueryRules description: Update log search Rule. operationId: microsoftAzureScheduledqueryrulesUpdate parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: '#/parameters/RuleNameParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter - name: parameters in: body required: true schema: $ref: '#/definitions/LogSearchRuleResourcePatch' description: The parameters of the rule to update. responses: '200': description: Successful request to update an Log Search rule schema: $ref: '#/definitions/LogSearchRuleResource' default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract' x-ms-examples: Patch Log Search Rule: $ref: ./examples/patchScheduledQueryRules.json summary: Microsoft Azure Patch Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules Rulename delete: description: Deletes a Log Search rule tags: - scheduledQueryRules operationId: microsoftAzureScheduledqueryrulesDelete parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: '#/parameters/RuleNameParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter responses: '200': description: Successful request to delete a Log Search rule '204': description: No Content. Resource not found default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract' x-ms-examples: Delete rule: $ref: ./examples/deleteScheduledQueryRules.json summary: Microsoft Azure Delete Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules Rulename /subscriptions/{subscriptionId}/providers/Microsoft.Insights/scheduledQueryRules: get: tags: - scheduledQueryRules operationId: microsoftAzureScheduledqueryrulesListbysubscription description: List the Log Search rules within a subscription group. parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter - $ref: '#/parameters/FilterParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter responses: '200': description: Successful request for a list of alert rules schema: $ref: '#/definitions/LogSearchRuleResourceCollection' default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract' x-ms-pageable: nextLinkName: null x-ms-examples: List rules: $ref: ./examples/listScheduledQueryRules.json x-ms-odata: '#/definitions/LogSearchRuleResource' summary: Microsoft Azure Get Subscriptions Subscriptionid Providers Microsoft Insights Scheduledqueryrules /subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Insights/scheduledQueryRules: get: tags: - scheduledQueryRules operationId: microsoftAzureScheduledqueryrulesListbyresourcegroup description: List the Log Search rules within a resource group. parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter - $ref: '#/parameters/FilterParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter responses: '200': description: Successful request for a list of alert rules schema: $ref: '#/definitions/LogSearchRuleResourceCollection' default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract' x-ms-pageable: nextLinkName: null x-ms-examples: List rules: $ref: ./examples/listScheduledQueryRules.json x-ms-odata: '#/definitions/LogSearchRuleResource' summary: Microsoft Azure Get Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/scheduledQueryRules: get: tags: - scheduledQueryRules description: Retrieve scheduled query rule definitions in a resource group. operationId: microsoftAzureScheduledqueryrulesListbyresourcegroup parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter responses: '200': description: Successful request for a list of scheduled query rules schema: $ref: '#/definitions/ScheduledQueryRuleResourceCollection' default: description: BadRequest schema: $ref: '#/definitions/ErrorContract_2' x-ms-pageable: nextLinkName: nextLink x-ms-examples: List scheduled query rules by resource group: $ref: ./examples/listScheduledQueryRulesByResourceGroup.json summary: Microsoft Azure Get Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/scheduledQueryRules/{ruleName} : get: tags: - scheduledQueryRules description: Retrieve an scheduled query rule definition. operationId: microsoftAzureScheduledqueryrulesGet parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: '#/parameters/RuleNameParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter responses: '200': description: Successful request to get a scheduled query rule schema: $ref: '#/definitions/ScheduledQueryRuleResource' default: description: BadRequest schema: $ref: '#/definitions/ErrorContract_2' x-ms-examples: Get a scheduled query rule for single resource: $ref: ./examples/getScheduledQueryRule.json summary: Microsoft Azure Get Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules Rulename put: tags: - scheduledQueryRules description: Creates or updates a scheduled query rule. operationId: microsoftAzureScheduledqueryrulesCreateorupdate parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: '#/parameters/RuleNameParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter - name: parameters in: body required: true schema: $ref: '#/definitions/ScheduledQueryRuleResource' description: The parameters of the rule to create or update. responses: '200': description: Successful request to update a scheduled query rule schema: $ref: '#/definitions/ScheduledQueryRuleResource' '201': description: Created a scheduled query rule schema: $ref: '#/definitions/ScheduledQueryRuleResource' default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract_2' x-ms-examples: Create or update a scheduled query rule for Single Resource: $ref: ./examples/createOrUpdateScheduledQueryRule.json Create or update a scheduled query rule on Resource group(s): $ref: ./examples/createOrUpdateScheduledQueryRuleResourceGroup.json 'Create or update a scheduled query rule on Subscription ': $ref: ./examples/createOrUpdateScheduledQueryRuleSubscription.json summary: Microsoft Azure Put Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules Rulename patch: tags: - scheduledQueryRules description: Update a scheduled query rule. operationId: microsoftAzureScheduledqueryrulesUpdate parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: '#/parameters/RuleNameParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter - name: parameters in: body required: true schema: $ref: '#/definitions/ScheduledQueryRuleResourcePatch' description: The parameters of the rule to update. responses: '200': description: Successful request to update a scheduled query rule schema: $ref: '#/definitions/ScheduledQueryRuleResource' default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract_2' x-ms-examples: Create or update a scheduled query rule: $ref: ./examples/patchScheduledQueryRule.json summary: Microsoft Azure Patch Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules Rulename delete: tags: - scheduledQueryRules description: Deletes a scheduled query rule. operationId: microsoftAzureScheduledqueryrulesDelete parameters: - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ResourceGroupNameParameter - $ref: '#/parameters/RuleNameParameter' - $ref: ../../../../../common-types/resource-management/v2/types.json#/parameters/ApiVersionParameter responses: '200': description: Successful request to delete a scheduled query rule '204': description: 'No content: the request was successful, but the response is empty' default: description: Error response describing why the operation failed. schema: $ref: '#/definitions/ErrorContract_2' x-ms-examples: Delete a scheduled query rule: $ref: ./examples/deleteScheduledQueryRule.json summary: Microsoft Azure Delete Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Insights Scheduledqueryrules Rulename definitions: ScheduledQueryRuleCriteria: type: object description: The rule criteria that defines the conditions of the scheduled query rule. properties: allOf: type: array description: A list of conditions to evaluate against the specified scopes items: $ref: '#/definitions/Condition' x-ms-identifiers: [] Condition: type: object description: A condition of the scheduled query rule. properties: query: type: string description: Log query alert timeAggregation: type: string description: Aggregation type. Relevant and required only for rules of the kind LogAlert. enum: - Count - Average - Minimum - Maximum - Total x-ms-enum: name: timeAggregation modelAsString: true metricMeasureColumn: type: string description: The column containing the metric measure number. Relevant only for rules of the kind LogAlert. resourceIdColumn: type: string description: The column containing the resource id. The content of the column must be a uri formatted as resource id. Relevant only for rules of the kind LogAlert. dimensions: type: array items: $ref: '#/definitions/Dimension' description: List of Dimensions conditions x-ms-identifiers: [] operator: type: string enum: - Equals - GreaterThan - GreaterThanOrEqual - LessThan - LessThanOrEqual x-ms-enum: name: conditionOperator modelAsString: true description: The criteria operator. Relevant and required only for rules of the kind LogAlert. threshold: type: number format: double description: the criteria threshold value that activates the alert. Relevant and required only for rules of the kind LogAlert. failingPeriods: type: object description: The minimum number of violations required within the selected lookback time window required to raise an alert. Relevant only for rules of the kind LogAlert. properties: numberOfEvaluationPeriods: type: integer format: int64 default: 1 description: The number of aggregated lookback points. The lookback time window is calculated based on the aggregation granularity (windowSize) and the selected number of aggregated points. Default value is 1 minFailingPeriodsToAlert: type: integer format: int64 default: 1 description: The number of violations to trigger an alert. Should be smaller or equal to numberOfEvaluationPeriods. Default value is 1 metricName: type: string description: The name of the metric to be sent. Relevant and required only for rules of the kind LogToMetric. ScheduledQueryRuleProperties: type: object properties: createdWithApiVersion: type: string readOnly: true description: The api-version used when creating this alert rule isLegacyLogAnalyticsRule: type: boolean readOnly: true description: True if alert rule is legacy Log Analytic rule description: type: string description: The description of the scheduled query rule. displayName: type: string description: The display name of the alert rule severity: type: integer format: int64 description: Severity of the alert. Should be an integer between [0-4]. Value of 0 is severest. Relevant and required only for rules of the kind LogAlert. enum: - 0 - 1 - 2 - 3 - 4 x-ms-enum: name: AlertSeverity modelAsString: true enabled: type: boolean description: The flag which indicates whether this scheduled query rule is enabled. Value should be true or false scopes: type: array items: type: string description: The list of resource id's that this scheduled query rule is scoped to. evaluationFrequency: type: string format: duration description: How often the scheduled query rule is evaluated represented in ISO 8601 duration format. Relevant and required only for rules of the kind LogAlert. windowSize: type: string format: duration description: The period of time (in ISO 8601 duration format) on which the Alert query will be executed (bin size). Relevant and required only for rules of the kind LogAlert. overrideQueryTimeRange: type: string format: duration description: If specified then overrides the query time range (default is WindowSize*NumberOfEvaluationPeriods). Relevant only for rules of the kind LogAlert. targetResourceTypes: type: array items: type: string description: List of resource type of the target resource(s) on which the alert is created/updated. For example if the scope is a resource group and targetResourceTypes is Microsoft.Compute/virtualMachines, then a different alert will be fired for each virtual machine in the resource group which meet the alert criteria. Relevant only for rules of the kind LogAlert criteria: $ref: '#/definitions/ScheduledQueryRuleCriteria' description: The rule criteria that defines the conditions of the scheduled query rule. muteActionsDuration: type: string format: duration description: Mute actions for the chosen period of time (in ISO 8601 duration format) after the alert is fired. Relevant only for rules of the kind LogAlert. actions: type: object $ref: '#/definitions/Actions' description: Actions to invoke when the alert fires. isWorkspaceAlertsStorageConfigured: type: boolean readOnly: true description: The flag which indicates whether this scheduled query rule has been configured to be stored in the customer's storage. The default is false. checkWorkspaceAlertsStorageConfigured: type: boolean description: The flag which indicates whether this scheduled query rule should be stored in the customer's storage. The default is false. Relevant only for rules of the kind LogAlert. skipQueryValidation: type: boolean description: The flag which indicates whether the provided query should be validated or not. The default is false. Relevant only for rules of the kind LogAlert. autoMitigate: type: boolean description: The flag that indicates whether the alert should be automatically resolved or not. The default is true. Relevant only for rules of the kind LogAlert. ruleResolveConfiguration: type: object $ref: '#/definitions/RuleResolveConfiguration' description: Defines the configuration for resolving fired alerts. Relevant only for rules of the kind LogAlert. description: scheduled query rule Definition Action: type: object discriminator: odata.type properties: odata.type: type: string description: Specifies the action. Supported values - AlertingAction, LogToMetricAction required: - odata.type description: Action descriptor. LogSearchRuleResourceCollection: type: object properties: value: type: array items: $ref: '#/definitions/LogSearchRuleResource' description: The values for the Log Search Rule resources. description: Represents a collection of Log Search rule resources. Resource: type: object properties: id: type: string readOnly: true description: Azure resource Id name: type: string readOnly: true description: Azure resource name type: type: string readOnly: true description: Azure resource type location: type: string description: Resource location x-ms-mutability: - create - read tags: type: object additionalProperties: type: string description: Resource tags kind: type: string readOnly: true description: Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type. If supported, the resource provider must validate and persist this value. etag: type: string readOnly: true description: 'The etag field is *not* required. If it is provided in the response body, it must also be provided as a header per the normal etag convention. Entity tags are used for comparing two or more entities from the same requested resource. HTTP/1.1 uses entity tags in the etag (section 14.19), If-Match (section 14.24), If-None-Match (section 14.26), and If-Range (section 14.27) header fields. ' required: - location x-ms-azure-resource: true description: An azure resource object ErrorContract_2: description: Describes the format of Error response. type: object properties: error: description: The error details. $ref: '#/definitions/ErrorResponseDetails' Source: type: object description: Specifies the log search query. properties: query: type: string description: Log search query. Required for action type - AlertingAction authorizedResources: type: array items: type: string description: List of Resource referred into query dataSourceId: type: string description: The resource uri over which log search query is to be run. queryType: $ref: '#/definitions/QueryType' description: Set value to 'ResultCount' . required: - dataSourceId LogSearchRuleResourcePatch: type: object properties: tags: type: object additionalProperties: type: string description: Resource tags properties: x-ms-client-flatten: true $ref: '#/definitions/LogSearchRulePatch' description: The log search rule properties of the resource. description: The log search rule resource for patch operations. ErrorContract: description: Describes the format of Error response. type: object properties: error: description: The error details. $ref: '#/definitions/ErrorResponse' ScheduledQueryRuleResourceCollection: type: object properties: value: type: array items: $ref: '#/definitions/ScheduledQueryRuleResource' description: The values for the scheduled query rule resources. nextLink: description: Provides the link to retrieve the next set of elements. type: string readOnly: true description: Represents a collection of scheduled query rule resources. RuleResolveConfiguration: type: object description: TBD. Relevant only for rules of the kind LogAlert. properties: autoResolved: type: boolean description: The flag that indicates whether or not to auto resolve a fired alert. timeToResolve: type: string format: duration description: The duration a rule must evaluate as healthy before the fired alert is automatically resolved represented in ISO 8601 duration format. Identity: properties: principalId: readOnly: true type: string description: The principal ID of resource identity. tenantId: readOnly: true type: string description: The tenant ID of resource. type: type: string description: Type of managed service identity. enum: - SystemAssigned - UserAssigned - None x-ms-enum: name: IdentityType modelAsString: false userAssignedIdentities: description: 'The list of user identities associated with the resource. The user identity dictionary key references will be ARM resource ids in the form: ''/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}''.' type: object additionalProperties: $ref: '#/definitions/UserIdentityProperties' required: - type type: object description: Identity for the resource. ScheduledQueryRuleResourcePatch: type: object properties: identity: $ref: '#/definitions/Identity' description: The identity of the resource. tags: type: object additionalProperties: type: string description: Resource tags properties: x-ms-client-flatten: true $ref: '#/definitions/ScheduledQueryRuleProperties' description: The scheduled query rule properties of the resource. description: The scheduled query rule resource for patch operations. ScheduledQueryRuleResource: type: object required: - properties - location properties: id: readOnly: true type: string description: Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName} name: readOnly: true type: string description: The name of the resource type: readOnly: true type: string description: The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts" identity: $ref: '#/definitions/Identity' description: The identity of the resource. tags: type: object additionalProperties: type: string x-ms-mutability: - read - create - update description: Resource tags. location: type: string x-ms-mutability: - read - create description: The geo-location where the resource lives kind: type: string description: Indicates the type of scheduled query rule. The default is LogAlert. enum: - LogAlert - LogToMetric x-ms-enum: name: Kind modelAsString: true etag: type: string readOnly: true description: 'The etag field is *not* required. If it is provided in the response body, it must also be provided as a header per the normal etag convention. Entity tags are used for comparing two or more entities from the same requested resource. HTTP/1.1 uses entity tags in the etag (section 14.19), If-Match (section 14.24), If-None-Match (section 14.26), and If-Range (section 14.27) header fields. ' systemData: $ref: ../../../../../common-types/resource-management/v2/types.json#/definitions/systemData description: SystemData of ScheduledQueryRule. readOnly: true properties: x-ms-client-flatten: true $ref: '#/definitions/ScheduledQueryRuleProperties' description: The rule properties of the resource. required: - enabled - criteria - scopes description: The scheduled query rule resource. x-ms-azure-resource: true QueryType: type: string enum: - ResultCount x-ms-enum: name: QueryType modelAsString: true description: Set value to 'ResultAccount' Dimension: type: object description: Dimension splitting and filtering definition properties: name: type: string description: Name of the dimension operator: type: string description: Operator for dimension values enum: - Include - Exclude x-ms-enum: name: dimensionOperator modelAsString: true values: type: array items: type: string description: List of dimension values required: - name - operator - values UserIdentityProperties: type: object description: User assigned identity properties. properties: principalId: readOnly: true description: The principal id of user assigned identity. type: string clientId: readOnly: true description: The client id of user assigned identity. type: string ErrorResponse: description: Describes the format of Error response. type: object properties: code: description: Error code type: string message: description: Error message indicating why the operation failed. type: string ErrorResponseDetails: title: Error Response description: Common error response for all Azure Resource Manager APIs to return error details for failed operations. (This also follows the OData error response format.) type: object properties: code: readOnly: true type: string description: The error code. message: readOnly: true type: string description: The error message. target: readOnly: true type: string description: The error target. details: readOnly: true type: array items: $ref: '#/definitions/ErrorResponseDetails' x-ms-identifiers: - message - target description: The error details. additionalInfo: readOnly: true type: array items: $ref: '#/definitions/ErrorResponseAdditionalInfo' x-ms-identifiers: [] description: The error additional info. Actions: type: object description: Actions to invoke when the alert fires. properties: actionGroups: type: array items: type: string description: Action Group resource Ids to invoke when the alert fires. customProperties: type: object additionalProperties: type: string description: The dictionary of custom properties to include with the post operation. These data are appended to the alert payload. description: The properties of an alert payload. actionProperties: type: object additionalProperties: type: string description: The dictionary of action properties to include with the post operation. This data customizes the actions. description: The properties of an action properties. LogSearchRulePatch: type: object description: Log Search Rule Definition for Patching properties: enabled: type: string description: The flag which indicates whether the Log Search rule is enabled. Value should be true or false enum: - 'true' - 'false' x-ms-enum: name: enabled modelAsString: true LogSearchRule: type: object description: Log Search Rule Definition properties: createdWithApiVersion: type: string readOnly: true description: The api-version used when creating this alert rule isLegacyLogAnalyticsRule: type: boolean readOnly: true description: True if alert rule is legacy Log Analytic rule description: type: string description: The description of the Log Search rule. displayName: type: string description: The display name of the alert rule autoMitigate: type: boolean default: false description: The flag that indicates whether the alert should be automatically resolved or not. The default is false. enabled: type: string description: The flag which indicates whether the Log Search rule is enabled. Value should be true or false enum: - 'true' - 'false' x-ms-enum: name: enabled modelAsString: true lastUpdatedTime: readOnly: true type: string format: date-time description: Last time the rule was updated in IS08601 format. provisioningState: readOnly: true type: string enum: - Succeeded - Deploying - Canceled - Failed x-ms-enum: name: provisioningState modelAsString: true description: Provisioning state of the scheduled query rule source: $ref: '#/definitions/Source' description: Data Source against which rule will Query Data schedule: $ref: '#/definitions/Schedule' description: Schedule (Frequency, Time Window) for rule. Required for action type - AlertingAction action: $ref: '#/definitions/Action' description: Action needs to be taken on rule execution. required: - source - action ErrorResponseAdditionalInfo: type: object properties: type: readOnly: true type: string description: The additional info type. info: readOnly: true type: object description: The additional info. description: The resource management error additional info. Schedule: type: object description: Defines how often to run the search and the time interval. properties: frequencyInMinutes: type: integer format: int32 description: frequency (in minutes) at which rule condition should be evaluated. timeWindowInMinutes: type: integer format: int32 description: Time window for which data needs to be fetched for query (should be greater than or equal to frequencyInMinutes). required: - frequencyInMinutes - timeWindowInMinutes LogSearchRuleResource: type: object allOf: - $ref: '#/definitions/Resource' required: - properties properties: properties: x-ms-client-flatten: true $ref: '#/definitions/LogSearchRule' description: The rule properties of the resource. description: The Log Search Rule resource. parameters: FilterParameter: name: $filter in: query required: false type: string description: The filter to apply on the operation. For more information please see https://msdn.microsoft.com/en-us/library/azure/dn931934.aspx x-ms-parameter-location: method RuleNameParameter: name: ruleName in: path required: true type: string description: The name of the rule. x-ms-parameter-location: method x-ms-parameterized-host: hostTemplate: '{endpoint}' useSchemePrefix: false parameters: - $ref: '#/parameters/Endpoint'