• first define a log search rule
• when it evaluates as positive, an alert is triggered
• these are stateless, so everytime threshold is breached it will create an alert regardless of whether alert was created already

How to trigger

• Number of logs
  • When a certain number of logs are generated, trigger an alert
• Metric measurement (similar to [[202408111240 Create an Azure metric alert|Create an azure metric alert]])

---

references:

MS Learn

Log alerts behave in a slightly different way than other alert mechanisms. The first part of a log alert defines the log search rule. The rule defines how often it should run, the time period under evaluation, and the query to be run. When a log search evaluates as positive, it creates an alert record and triggers any associated actions.

Log search components:

• Log query: Query that runs every time the alert rule fires
• Time period: Time range for the query
• Frequency: How often the query should run
• Threshold: Trigger point for an alert to be created