azure - Cannot create scheduled-query via az cli - how does the condition parse?

Question

I'm trying to set a log query alert through the az cli but I cannot for the life of me get the --condition option to accept a query with a quote in it.

E.g.:

az monitor scheduled-query create -n "Log Alert" -g rg --scopes /subscriptions/xxxx/resourceGroups/xxxx/providers/microsoft.insights/components/ai --condition "count 'customEvents | where name == "Event" ' > 360" --description "Check something"

But I just get this error:

cli.azure.cli.core.azclierror : BadRequestError: BadRequest: {
  "error": {
    "message": "The request had some invalid properties",
    "code": "BadArgumentError",
    "correlationId": "xxxx",
    "innererror": {
      "code": "SemanticError",
      "message": "A semantic error occurred.",
      "innererror": {
        "code": "SEM0100",
        "message": "'where' operator: Failed to resolve scalar expression named 'Event'"
      }
    }
  }
}
BadRequestError: BadRequest: {
  "error": {
    "message": "The request had some invalid properties",
    "code": "BadArgumentError",
    "correlationId": "xxxx",
    "innererror": {
      "code": "SemanticError",
      "message": "A semantic error occurred.",
      "innererror": {
        "code": "SEM0100",
        "message": "'where' operator: Failed to resolve scalar expression named 'Event'"
      }
    }
  }
}

I'm copying the example on the docs https://docs.microsoft.com/en-us/cli/azure/ext/scheduled-query/monitor/scheduled-query?view=azure-cli-latest#ext_scheduled_query_az_monitor_scheduled_query_create but I can't find the right combination of quote marks or escape characters to get this to parse, I've tried from a windows powershell and a bash cloud shell but that makes no difference.

question from:https://stackoverflow.com/questions/65849448/cannot-create-scheduled-query-via-az-cli-how-does-the-condition-parse

Answer 1

I suspect the new feature of creating scheduled query via cli is not available. I found an issue that mentions this code is not merged into master branch.

To escape double quotes for "Event", you can modify it as "Event". And then run the command, you will get an error message which provides the usage of --condition. But I tried many ways as per this tips, no good luck. Regards the issue mentioned above, I though it's currently impossible to create it via azure cli.

If azure cli is not a must, you can try use azure powershell New-AzScheduledQueryRule cmdlet.