swagger: "2.0"
schemes:
  - https
host: management.azure.com
info:
  description: Azure Monitor client to create/update/delete Scheduled Query Rules
  title: Microsoft Insights
  version: 2018-04-16
  x-apisguru-categories:
    - cloud
  x-logo:
    url: https://api.apis.guru/v2/cache/logo/https_assets.onestore.ms_cdnfiles_onestorerolling-1606-01000_shell_v3_images_logo_microsoft.png
  x-origin:
    - format: swagger
      url: https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/specification/monitor/resource-manager/Microsoft.Insights/stable/2018-04-16/scheduledQueryRule_API.json
      version: "2.0"
  x-providerName: azure.com
  x-serviceName: monitor-scheduledQueryRule_API
  x-tags:
    - Azure
    - Microsoft
consumes:
  - application/json
produces:
  - application/json
securityDefinitions:
  azure_auth:
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    description: Azure Active Directory OAuth2 Flow
    flow: implicit
    scopes:
      user_impersonation: impersonate your user account
    type: oauth2
security:
  - azure_auth:
      - user_impersonation
parameters:
  ApiVersionParameter:
    description: Client Api Version.
    in: query
    name: api-version
    required: true
    type: string
  FilterParameter:
    description: The filter to apply on the operation. For more information please see https://msdn.microsoft.com/en-us/library/azure/dn931934.aspx
    in: query
    name: $filter
    required: false
    type: string
    x-ms-parameter-location: method
  ResourceGroupNameParameter:
    description: The name of the resource group.
    in: path
    name: resourceGroupName
    required: true
    type: string
    x-ms-parameter-location: method
  RuleNameParameter:
    description: The name of the rule.
    in: path
    name: ruleName
    required: true
    type: string
    x-ms-parameter-location: method
  SubscriptionIdParameter:
    description: The Azure subscription Id.
    in: path
    name: subscriptionId
    required: true
    type: string
paths:
  "/subscriptions/{subscriptionId}/providers/microsoft.insights/scheduledQueryRules":
    get:
      description: List the Log Search rules within a subscription group.
      operationId: ScheduledQueryRules_ListBySubscription
      parameters:
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/FilterParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Successful request for a list of alert rules
          schema:
            $ref: "#/definitions/LogSearchRuleResourceCollection"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      tags:
        - scheduledQueryRules
      x-ms-examples:
        List rules:
          parameters:
            api-version: 2018-03-01
            resourceGroupName: gigtest
            subscriptionId: 14ddf0c5-77c5-4b53-84f6-e1fa43ad68f7
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo
                    location: West US
                    name: logalertfoo
                    properties:
                      action:
                        aznsAction:
                          actionGroup: []
                          customWebhookPayload: "{}"
                          emailSubject: Email Header
                        odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                        severity: "1"
                        trigger:
                          metricTrigger:
                            metricColumn: user_Id
                            metricTriggerType: Total
                            threshold: 2
                            thresholdOperator: LessThan
                          threshold: 2
                          thresholdOperator: GreaterThan
                      description: log alert description
                      enabled: "false"
                      lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                      provisioningState: Succeeded
                      schedule:
                        frequencyInMinutes: 15
                        timeWindowInMinutes: 15
                      source:
                        dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                        query: requests
                        queryType: ResultCount
                    tags: {}
                    type: Microsoft.Insights/scheduledQueryRules
                  - id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo
                    location: West US
                    name: logalertfoo
                    properties:
                      action:
                        aznsAction:
                          actionGroup: []
                          customWebhookPayload: "{}"
                          emailSubject: Email Header
                        odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                        severity: "1"
                        trigger:
                          threshold: 3
                          thresholdOperator: GreaterThan
                      description: log alert description
                      enabled: "true"
                      lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                      provisioningState: Succeeded
                      schedule:
                        frequencyInMinutes: 10
                        timeWindowInMinutes: 30
                      source:
                        dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                        query: requests
                        queryType: ResultCount
                    tags: {}
                    type: Microsoft.Insights/scheduledQueryRules
              headers: {}
      x-ms-odata: "#/definitions/LogSearchRuleResource"
      x-ms-pageable:
        nextLinkName: null
  "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules":
    get:
      description: List the Log Search rules within a resource group.
      operationId: ScheduledQueryRules_ListByResourceGroup
      parameters:
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/FilterParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Successful request for a list of alert rules
          schema:
            $ref: "#/definitions/LogSearchRuleResourceCollection"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      tags:
        - scheduledQueryRules
      x-ms-examples:
        List rules:
          parameters:
            api-version: 2018-03-01
            resourceGroupName: gigtest
            subscriptionId: 14ddf0c5-77c5-4b53-84f6-e1fa43ad68f7
          responses:
            "200":
              body:
                value:
                  - id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo
                    location: West US
                    name: logalertfoo
                    properties:
                      action:
                        aznsAction:
                          actionGroup: []
                          customWebhookPayload: "{}"
                          emailSubject: Email Header
                        odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                        severity: "1"
                        trigger:
                          metricTrigger:
                            metricColumn: user_Id
                            metricTriggerType: Total
                            threshold: 2
                            thresholdOperator: LessThan
                          threshold: 2
                          thresholdOperator: GreaterThan
                      description: log alert description
                      enabled: "false"
                      lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                      provisioningState: Succeeded
                      schedule:
                        frequencyInMinutes: 15
                        timeWindowInMinutes: 15
                      source:
                        dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                        query: requests
                        queryType: ResultCount
                    tags: {}
                    type: Microsoft.Insights/scheduledQueryRules
                  - id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo
                    location: West US
                    name: logalertfoo
                    properties:
                      action:
                        aznsAction:
                          actionGroup: []
                          customWebhookPayload: "{}"
                          emailSubject: Email Header
                        odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                        severity: "1"
                        trigger:
                          threshold: 3
                          thresholdOperator: GreaterThan
                      description: log alert description
                      enabled: "true"
                      lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                      provisioningState: Succeeded
                      schedule:
                        frequencyInMinutes: 10
                        timeWindowInMinutes: 30
                      source:
                        dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                        query: requests
                        queryType: ResultCount
                    tags: {}
                    type: Microsoft.Insights/scheduledQueryRules
              headers: {}
      x-ms-odata: "#/definitions/LogSearchRuleResource"
      x-ms-pageable:
        nextLinkName: null
  "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/microsoft.insights/scheduledQueryRules/{ruleName}":
    delete:
      description: Deletes a Log Search rule
      operationId: ScheduledQueryRules_Delete
      parameters:
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/RuleNameParameter"
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Successful request to delete a  Log Search rule
        "204":
          description: No Content. Resource not found
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      tags:
        - scheduledQueryRules
      x-ms-examples:
        Delete rule:
          parameters:
            api-version: 2018-04-16
            resourceGroupName: Rac46PostSwapRG
            ruleName: logalertfoo
            subscriptionId: b67f7fec-69fc-4974-9099-a26bd6ffeda3
          responses:
            "200": {}
            "204": {}
    get:
      description: Gets an Log Search rule
      operationId: ScheduledQueryRules_Get
      parameters:
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/RuleNameParameter"
        - $ref: "#/parameters/ApiVersionParameter"
        - $ref: "#/parameters/SubscriptionIdParameter"
      responses:
        "200":
          description: Successful request to get a Log Search rule
          schema:
            $ref: "#/definitions/LogSearchRuleResource"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      tags:
        - scheduledQueryRules
      x-ms-examples:
        Get rule:
          parameters:
            api-version: 2018-04-16
            resourceGroupName: Rac46PostSwapRG
            ruleName: logalertfoo
            subscriptionId: b67f7fec-69fc-4974-9099-a26bd6ffeda3
          responses:
            "200":
              body:
                id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo
                location: West US
                name: logalertfoo
                properties:
                  action:
                    aznsAction:
                      actionGroup: []
                      customWebhookPayload: "{}"
                      emailSubject: Email Header
                    odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                    severity: "1"
                    trigger:
                      threshold: 3
                      thresholdOperator: GreaterThan
                  description: log alert description
                  enabled: "true"
                  lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                  provisioningState: Succeeded
                  schedule:
                    frequencyInMinutes: 15
                    timeWindowInMinutes: 15
                  source:
                    dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                    query: requests
                    queryType: ResultCount
                tags: {}
                type: Microsoft.Insights/scheduledQueryRules
              headers: {}
    patch:
      description: Update log search Rule.
      operationId: ScheduledQueryRules_Update
      parameters:
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/RuleNameParameter"
        - $ref: "#/parameters/ApiVersionParameter"
        - description: The parameters of the rule to update.
          in: body
          name: parameters
          required: true
          schema:
            $ref: "#/definitions/LogSearchRuleResourcePatch"
      responses:
        "200":
          description: Successful request to update an Log Search rule
          schema:
            $ref: "#/definitions/LogSearchRuleResource"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      tags:
        - scheduledQueryRules
      x-ms-examples:
        Patch Log Search Rule:
          parameters:
            api-version: 2018-04-16
            parameters:
              properties:
                enabled: "true"
            resourceGroupName: my-resource-group
            ruleName: logalertfoo
            subscriptionId: subid
          responses:
            "200":
              body:
                id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo
                location: West US
                name: logalertfoo
                properties:
                  action:
                    aznsAction:
                      actionGroup: []
                      customWebhookPayload: "{}"
                      emailSubject: Email Header
                    odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                    severity: "1"
                    trigger:
                      metricTrigger:
                        metricColumn: ColumnName
                        metricTriggerType: Consecutive
                        threshold: 5
                        thresholdOperator: GreaterThan
                      threshold: 3
                      thresholdOperator: GreaterThan
                  description: log alert description
                  enabled: "true"
                  lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                  provisioningState: Succeeded
                  schedule:
                    frequencyInMinutes: 15
                    timeWindowInMinutes: 15
                  source:
                    dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                    query: requests
                    queryType: ResultCount
                tags: {}
                type: Microsoft.Insights/scheduledQueryRules
              headers: {}
    put:
      description: Creates or updates an log search rule.
      operationId: ScheduledQueryRules_CreateOrUpdate
      parameters:
        - $ref: "#/parameters/SubscriptionIdParameter"
        - $ref: "#/parameters/ResourceGroupNameParameter"
        - $ref: "#/parameters/RuleNameParameter"
        - $ref: "#/parameters/ApiVersionParameter"
        - description: The parameters of the rule to create or update.
          in: body
          name: parameters
          required: true
          schema:
            $ref: "#/definitions/LogSearchRuleResource"
      responses:
        "200":
          description: Successful request to update an Log Search rule
          schema:
            $ref: "#/definitions/LogSearchRuleResource"
        "201":
          description: Created alert rule
          schema:
            $ref: "#/definitions/LogSearchRuleResource"
        default:
          description: Error response describing why the operation failed.
          schema:
            $ref: "#/definitions/ErrorResponse"
      tags:
        - scheduledQueryRules
      x-ms-examples:
        Create or Update rule - AlertingAction:
          parameters:
            api-version: 2018-04-16
            parameters:
              location: eastus
              properties:
                action:
                  aznsAction:
                    actionGroup: []
                    customWebhookPayload: "{}"
                    emailSubject: Email Header
                  odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                  severity: "1"
                  trigger:
                    metricTrigger:
                      metricColumn: Computer
                      metricTriggerType: Consecutive
                      threshold: 5
                      thresholdOperator: GreaterThan
                    threshold: 3
                    thresholdOperator: GreaterThan
                description: log alert description
                enabled: "true"
                lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                provisioningState: Succeeded
                schedule:
                  frequencyInMinutes: 15
                  timeWindowInMinutes: 15
                source:
                  dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/Microsoft.OperationalInsights/workspaces/sampleWorkspace
                  query: Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)
                  queryType: ResultCount
              tags: {}
            resourceGroupName: Rac46PostSwapRG
            ruleName: logalertfoo
            subscriptionId: b67f7fec-69fc-4974-9099-a26bd6ffeda3
          responses:
            "200":
              body:
                id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo
                location: eastus
                name: logalertfoo
                properties:
                  action:
                    aznsAction:
                      actionGroup: []
                      customWebhookPayload: "{}"
                      emailSubject: Email Header
                    odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                    severity: "1"
                    trigger:
                      metricTrigger:
                        metricColumn: Computer
                        metricTriggerType: Consecutive
                        threshold: 5
                        thresholdOperator: GreaterThan
                      threshold: 3
                      thresholdOperator: GreaterThan
                  description: log alert description
                  enabled: "true"
                  lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                  provisioningState: Succeeded
                  schedule:
                    frequencyInMinutes: 15
                    timeWindowInMinutes: 15
                  source:
                    dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/Microsoft.OperationalInsights/workspaces/sampleWorkspace
                    query: Heartbeat | summarize AggregatedValue = count() by bin(TimeGenerated, 5m)
                    queryType: ResultCount
                tags: {}
                type: Microsoft.Insights/scheduledQueryRules
              headers: {}
            "201":
              body:
                id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/logalertfoo
                location: eastus
                name: logalertfoo
                properties:
                  action:
                    aznsAction:
                      actionGroup: []
                      customWebhookPayload: "{}"
                      emailSubject: Email Header
                    odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                    severity: "1"
                    trigger:
                      threshold: 3
                      thresholdOperator: GreaterThan
                  description: log alert description
                  enabled: "true"
                  lastUpdatedTime: 2017-06-23T21:23:52.0221265Z
                  provisioningState: Succeeded
                  schedule:
                    frequencyInMinutes: 15
                    timeWindowInMinutes: 15
                  source:
                    dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/Microsoft.OperationalInsights/workspaces/sampleWorkspace
                    query: Heartbeat
                    queryType: ResultCount
                tags: {}
                type: Microsoft.Insights/scheduledQueryRules
              headers: {}
        Create or Update rule - AlertingAction with Cross-Resource:
          parameters:
            api-version: 2018-04-16
            parameters:
              location: eastus
              properties:
                action:
                  aznsAction:
                    actionGroup:
                      - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/actiongroups/test-ag
                    emailSubject: Cross Resource Mail!!
                  odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                  severity: "3"
                  trigger:
                    threshold: 5000
                    thresholdOperator: GreaterThan
                description: Sample Cross Resource alert
                enabled: "true"
                schedule:
                  frequencyInMinutes: 60
                  timeWindowInMinutes: 60
                source:
                  authorizedResources:
                    - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/Microsoft.OperationalInsights/workspaces/sampleWorkspace
                    - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                  dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                  query: union requests, workspace("sampleWorkspace").Update
                  queryType: ResultCount
              tags: {}
            resourceGroupName: Rac46PostSwapRG
            ruleName: SampleCrossResourceAlert
            subscriptionId: b67f7fec-69fc-4974-9099-a26bd6ffeda3
          responses:
            "200":
              body:
                id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/SampleCrossResourceAlert
                location: eastus
                name: SampleCrossResourceAlert
                properties:
                  action:
                    aznsAction:
                      actionGroup:
                        - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/actiongroups/test-ag
                      emailSubject: Cross Resource Mail!!
                    odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                    severity: "3"
                    trigger:
                      threshold: 5000
                      thresholdOperator: GreaterThan
                  description: Sample Cross Resource alert
                  enabled: "true"
                  lastUpdatedTime: 2018-09-04T06:27:58.3892575Z
                  provisioningState: Succeeded
                  schedule:
                    frequencyInMinutes: 60
                    timeWindowInMinutes: 60
                  source:
                    authorizedResources:
                      - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/Microsoft.OperationalInsights/workspaces/sampleWorkspace
                      - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                    dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                    query: union requests, workspace("sampleWorkspace").Update
                    queryType: ResultCount
                tags: {}
                type: Microsoft.Insights/scheduledQueryRules
              headers: {}
            "201":
              body:
                id: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/scheduledQueryRules/SampleCrossResourceAlert
                location: eastus
                name: SampleCrossResourceAlert
                properties:
                  action:
                    aznsAction:
                      actionGroup:
                        - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/actiongroups/test-ag
                      emailSubject: Cross Resource Mail!!
                    odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
                    severity: "3"
                    trigger:
                      threshold: 5000
                      thresholdOperator: GreaterThan
                  description: Sample Cross Resource alert
                  enabled: "true"
                  lastUpdatedTime: 2018-09-04T06:27:58.3892575Z
                  provisioningState: Succeeded
                  schedule:
                    frequencyInMinutes: 60
                    timeWindowInMinutes: 60
                  source:
                    authorizedResources:
                      - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/Microsoft.OperationalInsights/workspaces/sampleWorkspace
                      - /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                    dataSourceId: /subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/Rac46PostSwapRG/providers/microsoft.insights/components/sampleAI
                    query: union requests, workspace("sampleWorkspace").Update
                    queryType: ResultCount
                tags: {}
                type: Microsoft.Insights/scheduledQueryRules
              headers: {}
        Create or Update rule - LogToMetricAction:
          parameters:
            api-version: 2018-04-16
            parameters:
              location: West Europe
              properties:
                action:
                  criteria:
                    - dimensions: []
                      metricName: Average_% Idle Time
                  odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction
                description: log to metric description
                enabled: "true"
                source:
                  dataSourceId: /subscriptions/af52d502-a447-4bc6-8cb7-4780fbb00490/resourceGroups/alertsweu/providers/Microsoft.OperationalInsights/workspaces/alertsweu
              tags: {}
            resourceGroupName: alertsweu
            ruleName: logtometricfoo
            subscriptionId: af52d502-a447-4bc6-8cb7-4780fbb00490
          responses:
            "200":
              body:
                id: /subscriptions/af52d502-a447-4bc6-8cb7-4780fbb00490/resourceGroups/alertsweu/providers/microsoft.insights/scheduledqueryrules/logtometricfoo
                location: westeurope
                name: logtometricfoo
                properties:
                  action:
                    criteria:
                      - dimensions: []
                        metricName: Average_% Idle Time
                    odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction
                  description: log to metric description
                  displayName: logtometricfoo
                  enabled: "true"
                  lastUpdatedTime: 2018-09-04T06:31:56.3737792Z
                  provisioningState: Succeeded
                  schedule: null
                  source:
                    dataSourceId: /subscriptions/af52d502-a447-4bc6-8cb7-4780fbb00490/resourceGroups/alertsweu/providers/Microsoft.OperationalInsights/workspaces/alertsweu
                    query: null
                tags: {}
                type: microsoft.insights/scheduledqueryrules
              headers: {}
            "201":
              body:
                id: /subscriptions/af52d502-a447-4bc6-8cb7-4780fbb00490/resourceGroups/alertsweu/providers/microsoft.insights/scheduledqueryrules/logtometricfoo
                location: westeurope
                name: logtometricfoo
                properties:
                  action:
                    criteria:
                      - dimensions: []
                        metricName: Average_% Idle Time
                    odata.type: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction
                  description: log to metric description
                  enabled: "true"
                  lastUpdatedTime: 2018-09-04T06:27:58.3892575Z
                  provisioningState: Succeeded
                  schedule: null
                  source:
                    dataSourceId: /subscriptions/af52d502-a447-4bc6-8cb7-4780fbb00490/resourceGroups/alertsweu/providers/Microsoft.OperationalInsights/workspaces/alertsweu
                    query: null
                tags: {}
                type: microsoft.insights/scheduledqueryrules
              headers: {}
definitions:
  Action:
    description: Action descriptor.
    discriminator: odata.type
    properties:
      odata.type:
        description: Specifies the action. Supported values - AlertingAction, LogToMetricAction
        type: string
    required:
      - odata.type
    type: object
  AlertSeverity:
    description: Severity Level of Alert
    enum:
      - "0"
      - "1"
      - "2"
      - "3"
      - "4"
    type: string
    x-ms-enum:
      modelAsString: true
      name: AlertSeverity
  AlertingAction:
    allOf:
      - $ref: "#/definitions/Action"
    description: Specify action need to be taken when rule type is Alert
    properties:
      aznsAction:
        $ref: "#/definitions/AzNsActionGroup"
        description: Azure action group reference.
      severity:
        $ref: "#/definitions/AlertSeverity"
        description: Severity of the alert
      throttlingInMin:
        description: time (in minutes) for which Alerts should be throttled or suppressed.
        format: int32
        type: integer
      trigger:
        $ref: "#/definitions/TriggerCondition"
        description: The trigger condition that results in the alert rule being.
    required:
      - trigger
      - severity
    type: object
    x-ms-discriminator-value: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction
  AzNsActionGroup:
    description: Azure action group
    properties:
      actionGroup:
        description: Azure Action Group reference.
        items:
          type: string
        type: array
      customWebhookPayload:
        description: Custom payload to be sent for all webhook URI in Azure action group
        type: string
      emailSubject:
        description: Custom subject override for all email ids in Azure action group
        type: string
    type: object
  ConditionalOperator:
    description: Result Condition Evaluation criteria. Supported Values - 'GreaterThan' or 'LessThan' or 'Equal'.
    enum:
      - GreaterThan
      - LessThan
      - Equal
    type: string
    x-ms-enum:
      modelAsString: true
      name: ConditionalOperator
  Criteria:
    description: Specifies the criteria for converting log to metric.
    properties:
      dimensions:
        description: List of Dimensions for creating metric
        items:
          $ref: "#/definitions/Dimension"
        type: array
      metricName:
        description: Name of the metric
        type: string
    required:
      - metricName
    type: object
  Dimension:
    description: Specifies the criteria for converting log to metric.
    properties:
      name:
        description: Name of the dimension
        type: string
      operator:
        description: Operator for dimension values
        enum:
          - Include
        type: string
        x-ms-enum:
          modelAsString: true
          name: operator
      values:
        description: List of dimension values
        items:
          type: string
        type: array
    required:
      - name
      - operator
      - values
    type: object
  ErrorResponse:
    description: Describes the format of Error response.
    properties:
      code:
        description: Error code
        type: string
      message:
        description: Error message indicating why the operation failed.
        type: string
    type: object
  LogMetricTrigger:
    description: A log metrics trigger descriptor.
    properties:
      metricColumn:
        description: Evaluation of metric on a particular column
        type: string
      metricTriggerType:
        $ref: "#/definitions/MetricTriggerType"
        description: Metric Trigger Type - 'Consecutive' or 'Total'
      threshold:
        description: The threshold of the metric trigger.
        format: double
        type: number
      thresholdOperator:
        $ref: "#/definitions/ConditionalOperator"
        description: Evaluation operation for Metric -'GreaterThan' or 'LessThan' or 'Equal'.
    type: object
  LogSearchRule:
    description: Log Search Rule Definition
    properties:
      action:
        $ref: "#/definitions/Action"
        description: Action needs to be taken on rule execution.
      description:
        description: The description of the Log Search rule.
        type: string
      enabled:
        description: The flag which indicates whether the Log Search rule is enabled. Value should be true or false
        enum:
          - "true"
          - "false"
        type: string
        x-ms-enum:
          modelAsString: true
          name: enabled
      lastUpdatedTime:
        description: Last time the rule was updated in IS08601 format.
        format: date-time
        readOnly: true
        type: string
      provisioningState:
        description: Provisioning state of the scheduled query rule
        enum:
          - Succeeded
          - Deploying
          - Canceled
          - Failed
        readOnly: true
        type: string
        x-ms-enum:
          modelAsString: true
          name: provisioningState
      schedule:
        $ref: "#/definitions/Schedule"
        description: Schedule (Frequency, Time Window) for rule. Required for action type - AlertingAction
      source:
        $ref: "#/definitions/Source"
        description: Data Source against which rule will Query Data
    required:
      - source
      - action
  LogSearchRulePatch:
    description: Log Search Rule Definition for Patching
    properties:
      enabled:
        description: The flag which indicates whether the Log Search rule is enabled. Value should be true or false
        enum:
          - "true"
          - "false"
        type: string
        x-ms-enum:
          modelAsString: true
          name: enabled
  LogSearchRuleResource:
    allOf:
      - $ref: "#/definitions/Resource"
    description: The Log Search Rule resource.
    properties:
      properties:
        $ref: "#/definitions/LogSearchRule"
        description: The rule properties of the resource.
        x-ms-client-flatten: true
    required:
      - properties
    type: object
  LogSearchRuleResourceCollection:
    description: Represents a collection of Log Search rule resources.
    properties:
      value:
        description: The values for the Log Search Rule resources.
        items:
          $ref: "#/definitions/LogSearchRuleResource"
        type: array
  LogSearchRuleResourcePatch:
    description: The log search rule resource for patch operations.
    properties:
      properties:
        $ref: "#/definitions/LogSearchRulePatch"
        description: The log search rule properties of the resource.
        x-ms-client-flatten: true
      tags:
        additionalProperties:
          type: string
        description: Resource tags
  LogToMetricAction:
    allOf:
      - $ref: "#/definitions/Action"
    description: Specify action need to be taken when rule type is converting log to metric
    properties:
      criteria:
        description: Criteria of Metric
        items:
          $ref: "#/definitions/Criteria"
        type: array
    required:
      - criteria
    type: object
    x-ms-discriminator-value: Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.LogToMetricAction
  MetricTriggerType:
    description: Metric Trigger Evaluation Type
    enum:
      - Consecutive
      - Total
    type: string
    x-ms-enum:
      modelAsString: true
      name: metricTriggerType
  QueryType:
    description: Set value to 'ResultAccount'
    enum:
      - ResultCount
    type: string
    x-ms-enum:
      modelAsString: true
      name: QueryType
  Resource:
    description: An azure resource object
    properties:
      id:
        description: Azure resource Id
        readOnly: true
        type: string
      location:
        description: Resource location
        type: string
        x-ms-mutability:
          - create
          - read
      name:
        description: Azure resource name
        readOnly: true
        type: string
      tags:
        additionalProperties:
          type: string
        description: Resource tags
      type:
        description: Azure resource type
        readOnly: true
        type: string
    required:
      - location
    x-ms-azure-resource: true
  Schedule:
    description: Defines how often to run the search and the time interval.
    properties:
      frequencyInMinutes:
        description: frequency (in minutes) at which rule condition should be evaluated.
        format: int32
        type: integer
      timeWindowInMinutes:
        description: Time window for which data needs to be fetched for query (should be greater than or equal to frequencyInMinutes).
        format: int32
        type: integer
    required:
      - frequencyInMinutes
      - timeWindowInMinutes
    type: object
  Source:
    description: Specifies the log search query.
    properties:
      authorizedResources:
        description: List of  Resource referred into query
        items:
          type: string
        type: array
      dataSourceId:
        description: The resource uri over which log search query is to be run.
        type: string
      query:
        description: Log search query. Required for action type - AlertingAction
        type: string
      queryType:
        $ref: "#/definitions/QueryType"
        description: Set value to 'ResultCount' .
    required:
      - dataSourceId
    type: object
  TriggerCondition:
    description: The condition that results in the Log Search rule.
    properties:
      metricTrigger:
        $ref: "#/definitions/LogMetricTrigger"
        description: Trigger condition for metric query rule
      threshold:
        description: Result or count threshold based on which rule should be triggered.
        format: double
        type: number
      thresholdOperator:
        $ref: "#/definitions/ConditionalOperator"
        description: Evaluation operation for rule - 'GreaterThan' or 'LessThan.
    required:
      - thresholdOperator
      - threshold
    type: object
