对于指标警报类型，搜索查询应包含“AggregatedValue”和“bin(timestamp, [roundTo])”

Question

我正在尝试根据 Application Insights 日志中的某些指标创建自定义指标警报。以下是我正在使用的查询；

let start = customEvents
| where customDimensions.configName == "configName" 
| where name == "name"
| extend timestamp, correlationId = tostring(customDimensions.correlationId), configName = tostring(customDimensions.configName);

let ending = customEvents
| where customDimensions.configName == configName" 
| where name == "anotherName" 
| where customDimensions.taskName == "taskName" 
| extend timestamp, correlationId = tostring(customDimensions.correlationId), configName = tostring(customDimensions.configName), name= name, nameTimeStamp= timestamp ;


let timeDiffs = start
| join (ending) on correlationId
| extend timeDiff = nameTimeStamp- timestamp
| project timeDiff, timestamp, nameTimeStamp, name, anotherName, correlationId;

timeDiffs
| summarize AggregatedValue=avg(timeDiff) by bin(timestamp, 1m)

当我在 Analytics 页面中运行此查询时，我得到了结果，但是当我尝试创建自定义指标警报时，我收到了错误 Search Query should contain 'AggregatedValue' and 'bin(timestamp, [roundTo])' for Metric alert type

我发现的唯一响应是添加AggregatedValue我已经拥有的响应，我不确定为什么自定义指标警报页面给我这个错误。

Answer 1

我发现我的查询有什么问题。本质上，聚合值需要是数字，但AggregatedValue=avg(timeDiff)产生时间值，但它以秒为单位，因此有点难以注意到。将其转换为 int 可以解决问题，

我刚刚更新了最后一点如下

timeDiffs
| summarize AggregatedValue=toint(avg(timeDiff)/time(1ms)) by bin(timestamp, 5m)

这Aggregate On在创建警报时带来了另一个挑战，因为AggregatedValue它不是by语句之后的分组的一部分。