Extending alerts for Log Analytics into Azure
Lately Microsoft has been helping to make the shift from the “classic” Log Analytics portal (https://www.microsoft.com/oms) to the Azure portal (https://portal.azure.com). We have seen how Log Analytics workspaces are now visible in the Azure portal and how we can pin top level views from Log Analytics to the Azure dashboard. We have seen new functionality such as the ability to change retention periods which are not available in the classic portal added to the Azure portal. Late last year they added the ability to view the alerts which you define in Log Analytics in the Azure portal. Once you have extended your alerts you will no longer be able to author new alerts in the “classic” Log Analytics portal.
You can extend your current Log Analytics workspace by clicking on the link shown above.
And then choosing to Extend into Azure. This brings you through a three step wizard which extends your alerts into Azure and creates an “Action Group” which will go into more depth on later in this blog post.
When you finish the process of extending into Azure you should see a message like this one.
Once you have extended your Log Analytics into Azure you will now see the following when you attempt to add an alert in Log Analytics:
As the various “Action Groups” are created you should receive email notifications that they are created. An example of these is shown below.
Your alerts can now be viewed in the Monitor portion of the Azure portal under Alerts / Manage Rules.
Summary: The process to extend your Log Analytics alerts into Azure is straightforward and appears to work well. If you don’t convert your alerts by May 14, 2018 it appears that these will occur automatically on their own after that timeframe. In my next blog post I will show a simple example for how to add an alert for Log Analytics in Azure.