Upgrade to the Scheduled Query Rules API from the legacy Log Analytics Alert API

In the past, users used the legacy Log Analytics Alert API to manage log search alert rules. Currently workspaces use the Scheduled Query Rules API for new rules. This article describes the benefits and the process of switching legacy log search alert rules management from the legacy API to the current API.

• Manage all log search alert rules in one API.
• Single template for creation of alert rules (previously needed three separate templates).
• Single API for all Azure resources log alerting.
• Support for stateful (preview) and 1-minute log search alerts.
• PowerShell cmdlets and Azure CLI support for switched rules.
• Alignment of severities with all other alert types and newer rules.
• Ability to create a cross workspace log alert that spans several external resources like Log Analytics workspaces or Application Insights resources for switched rules.
• Users can specify dimensions to split the alerts for switched rules.
• Log search alerts have an extended period of up to two days of data (previously limited to one day) for switched rules.

• All switched rules must be created/edited with the current API. See sample use via Azure Resource Template and sample use via PowerShell.
• As rules become Azure Resource Manager tracked resources in the current API and must be unique, the resource IDs for the rules change to this structure: <WorkspaceName>|<savedSearchId>|<scheduleId>|<ActionId>. Display names for the alert rules remain unchanged.

View workspaces to upgrade using this Azure Resource Graph Explorer query. Open the link, select all available subscriptions, and run the query.

The process of switching isn't interactive and doesn't require manual steps, in most cases. Your alert rules aren't stopped or stalled, during or after the switch. Do this call to switch all alert rules associated with each of the Log Analytics workspaces:

PUT /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/alertsversion?api-version=2017-04-26-preview

With request body containing the below JSON:

{
    "scheduledQueryRulesEnabled" : true
}

Here is an example of using ARMClient, an open-source command-line tool, that simplifies invoking the above API call:

$switchJSON = '{"scheduledQueryRulesEnabled": true}'
armclient PUT /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/alertsversion?api-version=2017-04-26-preview $switchJSON

You can also use the Azure CLI tool:

az rest --method put --url /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/alertsversion?api-version=2017-04-26-preview --body "{\"scheduledQueryRulesEnabled\" : true}"

If the switch is successful, the response is:

{
    "version": 2,
    "scheduledQueryRulesEnabled" : true
}

You can also use this API call to check the switch status:

GET /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/alertsversion?api-version=2017-04-26-preview

You can also use the ARMClient tool:

armclient GET /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/alertsversion?api-version=2017-04-26-preview

You can also use the Azure CLI tool:

az rest --method get --url /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/alertsversion?api-version=2017-04-26-preview

If the Log Analytics workspace was switched to scheduledQueryRules API, the response is:

{
    "version": 2,
    "scheduledQueryRulesEnabled" : true
}

If the Log Analytics workspace wasn't switched, the response is:

{
    "version": 2,
    "scheduledQueryRulesEnabled" : false
}

• Learn about the Azure Monitor log search alerts.
• Learn how to manage your log search alerts using the API.
• Learn how to manage your log search alerts using PowerShell.
• Learn more about the Azure Alerts experience.