Please detail a tested, valid, real world example of a log search alert webhook body

[willmorgan]

Both documentation examples are invalid JSON and are of different data shapes. Notably, the format of the webhook appears to be different to that of standard Azure Alerts.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: b1390bec-bae0-2fe7-a29c-a242584fd7b3
• Version Independent ID: 27892ee4-2ec3-ea70-f747-80a9bc914fd7
• Content: Webhook actions for log alerts in Azure Alerts
• Content Source: articles/monitoring-and-diagnostics/monitor-alerts-unified-log-webhook.md
• Service: monitoring-and-diagnostics
• GitHub Login: @msvijayn
• Microsoft Alias: vinagara

[femsulu]

@willmorgan Thanks for the comment. Your feedback has been shared with the content owner. We will get back to you shortly.

[msvijayn]

@willmorgan Kindly elaborate what the issue you're seeing with the webhook from Log Alerts. The webhook samples shown in doc, are indicative of real-world output you'll get using custom log search based Azure Alerts for Application Insights app or Log Analytics workspace chosen.

Since these are query based alerts, their format can not be same as metric alerts. Both log alerts and metric alerts are part of Azure Alerts and usable from Azure Monitor - Alerts section.

[willmorgan]

@msvijayn If you copy a few of those examples into an IDE or JSON validator you'll see that the JSON isn't valid. To me this suggests that these aren't the real output of what the webhook sends.

[msvijayn]

@willmorgan thanks, for the clarification. Yes, you are right the webhook provided aren't meeting JSON RFC 4627 validation. I am updating the doc with correction.

PR #37346

[msvijayn]

#in-progress

[msvijayn]

PR has merged and doc has been updated

[msvijayn]

@femsulu @willmorgan #please-close

[willmorgan]

Thanks @msvijayn. Just to confirm, this is captured from a real webhook request sent from Azure, right?

[msvijayn]

@willmorgan Yes, it is a real webhook sent from log alerts; abet minor changes to replace critical data like subscription and search result URL - with dummy values for documentation use.

[willmorgan]

Okay, just making sure, because the indentation looks like it's been through an IDE or something 🙂

Thanks for confirming.

[msvijayn]

@willmorgan - Ooh, yes I have done indentation - as its a mandate for readability in docs. In real world, you'll get the webhook as a continual JSON payload with no such indentation.