警报在字符串中具有搜索词的查询时抛出错误 [英] Alerts throwing error for query having search word in a string

问题描述

我有一个在分析中运行良好的查询，但是在警报中给出错误时会发出错误消息"警告不兼容的命令，如'搜索'，'union *'使用。"

查询有一些硬编码字符串，其中一个字符串包含搜索字。如果我删除包含搜索词的字符串，则查询在警报中正常工作。

看起来字符串中的搜索词在警报中以某种方式被视为搜索关键字。

知道为什么会发生这种情况吗？

解决方案

Hello  samoi1239 ，

感谢您提请我们注意！

正如官方
文档：

从20119年1月11日开始，创建或修改日志警报规则inAzure门户网站不支持使用搜索或联合运算符。在警报规则中使用这些运算符将返回错误消息。使用Log Analytics API创建的现有警报规则和警报规则
不受此更改的影响。您仍应考虑更改使用这些类型查询的任何警报规则，以提高效率。

看起来似乎是"搜索"在这里的字符串被视为"搜索" Kusto的运营商。

我正在积极地与产品组进行调查，并会在收到的回复中公布您的信息！

I have a query which runs fine in analytics, but throws error when given in alerts with message "Alert incompatible command like 'search', 'union*' used."

The query has a few hard coded strings and one of the string contains search word. If I remove the string containing search word, query works fine in alerts.

Looks like the search word in string is being treated as search keyword somehow in Alerts.

Any idea why its happening so?

解决方案

Hello samoi1239,

Thanks for bringing this to our attention!

As mentioned in the Official documentation:

Starting January 11,2019, creating or modifying log alert rules that use search, or union operators will not be supported the in Azure portal. Using these operators in an alert rule will return an error message. Existing alert rules and alert rules created and edited with the Log Analytics API are not affected by this change. You should still consider changing any alert rules that use these types of queries though to improve their efficiency.

It does seem like "search" in the string here is being treated as the "search" operator in Kusto.

I'm actively investigating this further with the Product Group, and will keep you posted on the response I receive!

这篇关于警报在字符串中具有搜索词的查询时抛出错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！