Include query results in application insights alert to webhook - webhooks

Question

I try to setup an application insights alert to a webhook (MS Teams to be precise). I already successfully managed to create the alert and the data is already sent to the webhook and displayed in Teams.
This is a log-alert.
All I am now missing is the query-RESULT of that log-alert.
The documentation [https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log-webhook#log-alert-with-a-custom-json-payload] simply states that I need to add a simple configuration-parameter into the payload:
"IncludeSearchResults":true
Which I did. But still no Json-Attachment (or anything else) to be seen containing the query result.
My complete payload (which works fine apart from the result-part) looks like this:
{
"#context": "http://schema.org/extensions",
"#type": "MessageCard",
"IncludeSearchResults":true,
"themeColor": "CC4216",
"title": "#alertrulename",
"text": "#alertrulename returned #searchresultcount records which exceeds the threshold of #thresholdvalue .",
"summary": "Query: #searchquery",
"potentialAction": [{
"#type": "OpenUri",
"name": "See details in AppInsights",
"targets": [{
"os": "default",
"uri": "#linktosearchresults"
}]
}],
"sections": [{
"facts": [{
"name": "Severity:",
"value": "#severity"
},
{
"name": "Query:",
"value": "#searchquery"
},
{
"name": "ResultCount:",
"value": "#searchresultcount"
},
{
"name": "Search Interval StartTime:",
"value": "#searchintervalstarttimeutc"
},
{
"name": "Search Interval End time:",
"value": "#searchintervalendtimeutc"
},
{
"name": "AppInsights Application ID:",
"value": "#applicationid"
}]
}]
}
What I want to achieve is that the "top 10 results" that are automatically added to any email-notification also be shown in Teams:

Answer 1

O365 connector card schema does not contain IncludeSearchResults property.
You will need to fetch the result and then bind the data to card.
Are you able to fetch the results?