Merge pull request #1484 from CDCgov/azure-log-alert

Azure Log Alert
CDCgov · Oct 24, 2024 · d1f00d6 · d1f00d6
2 parents cd778c1 + 1e1d975
commit d1f00d6
Showing 1 changed file with 4 additions and 7 deletions.
diff --git a/operations/template/alert.tf b/operations/template/alert.tf
@@ -260,22 +260,19 @@ resource "azurerm_monitor_scheduled_query_rules_alert" "ti-log-errors-alert" {
 
   query = <<-QUERY
       AppServiceConsoleLogs
-      | where TimeGenerated >= ago(00.001m)
-      and TimeGenerated <= now()
       | project columnifexists("ResultDescription", 'default_value')
       | project  JsonResult = parse_json(ResultDescription)
-      | evaluate bag_unpack(JsonResult) : (level:string)
+      | evaluate bag_unpack(JsonResult) : (level: string, message: string)
       | where level in ( 'ERROR' )
-      | summarize count()
     QUERY
 
   severity                = 3
-  frequency               = 10
-  time_window             = 30
+  frequency               = 5
+  time_window             = 15
   auto_mitigation_enabled = true
 
   trigger {
-    operator  = "GreaterThan"
+    operator  = "GreaterThanOrEqual"
     threshold = 1
   }