properties.search.query is not a valid log or metric query - azure

Question

I have an Azure resource manager template that quite often, but now always, give me a strange error when I try to deploy it. My gut feeling is that this started a few days ago, but I’m not sure what the reason is. The deployments most of the times end with the error message:
"error": {
"code": "properties.search.query is not a valid log or metric query.An error occurred while sending the request.",
"message": {
"lang": "en-US",
"value": "properties.search.query is not a valid log or metric query.An error occurred while sending the request."
},
"innererror": {
"stacktrace": "System.ArgumentException: properties.search.query is not a valid log or metric query.An error occurred while sending the request.\r\n at Microsoft.AppInsights.Nexus.ResourceProvider.Validation.Ensure.IsTrue(Boolean value, String message)…
This doesn’t say me much :-( I have noticed that they deployment works fine if I remove this section from my template:
{
"name": "[concat('ExceptionOccured ', variables('insightsNames')[copyIndex()])]",
"apiVersion": "2018-04-16",
"type": "Microsoft.Insights/scheduledQueryRules",
"location": "East US",
"tags": {
"[concat('hidden-link:', resourceId('microsoft.insights/components', variables('insightsNames')[copyIndex()]))]": "Resource"
},
"properties": {
"description": "Some exception has been logged.",
"enabled": "true",
"source": {
"query": "exceptions",
"authorizedResources": [],
"dataSourceId": "[resourceId('microsoft.insights/components', variables('insightsNames')[copyIndex()])]",
"queryType": "ResultCount"
},
"schedule": {
"frequencyInMinutes": 60,
"timeWindowInMinutes": 60
},
"action": {
"severity": "1",
"status": "Active",
"aznsAction": {
"actionGroup": [
"[resourceId('microsoft.insights/actionGroups', variables('alertGroupName'))]"
]
},
"trigger": {
"thresholdOperator": "GreaterThan",
"threshold": 0,
"consecutiveBreach": 1
},
"odata.type": "Microsoft.WindowsAzure.Management.Monitoring.Alerts.Models.Microsoft.AppInsights.Nexus.DataContracts.Resources.ScheduledQueryRules.AlertingAction"
}
},
"dependsOn": [
"[resourceId('microsoft.insights/components', variables('insightsNames')[copyIndex()])]",
"[resourceId('microsoft.insights/actionGroups', variables('alertGroupName'))]"
],
"copy": {
"name": "insightscopy",
"count": "[length(variables('insightsNames'))]"
},
"condition": "[greater(length(parameters('alertEmail')), 0)]"
},
This is a loop to setup alerts for some application insights projects. Is there some error in this section?

Answer 1

I started getting this yesterday too. Same alerting structure, same error. I tried ~30mins later and it worked fine. Not what you wanted to hear, but I couldnt't find the reason why either.