Customize log search alert email subjects (preview)

You can override log search alert email subjects with static text, dynamic values extracted from the alert payload or a combination of both.

This article explains how to customize Log search alert email subjects in Azure Monitor by using an Azure Resource Manager template (ARM template) for personalized notifications.

Prerequisites

To create or edit an alert rule, you must have the following permissions:

• Read permission on the target resource of the alert rule.
• Write permission on the resource group in which the alert rule is created. If you're creating the alert rule from the Azure portal, the alert rule is created by default in the same resource group in which the target resource resides.
• Read permission on any action group associated to the alert rule, if applicable.

Use an ARM template

To create an alert rule with a customized email subject, use a template from the Resource Manager template samples for log search alerts. Be sure to use the latest API version 2023-12-01. Use the template from the Resource Manager template sample for simple log search alert rules for Simple log search alert rules.

Add the actionProperties object and include the Email.Subject property. For example:

{
  "actionProperties": {
    "Email.Subject": "This is a custom email subject"
  }
}

Use dynamic values

The format for extracting a dynamic value from the alert payload is: ${<path to schema field>}, for example: ${data.essentials.monitorCondition}.

Examples

This example creates an email subject containing the affected resource and whether it was fired or resolved.

{
  "actionProperties": {
    "Email.Subject": "Alert ${data.essentials.monitorCondition} on ${data.essentials.alertTargetIDs}"
  }
}

Potential results:

• Alert Fired on VM1.
• Alert Resolved on VM1.

This example creates an email subject containing the count of errors on the affected resource:

{
  "actionProperties": {
    "Email.Subject": "${data.alertContext.condition.allOf[0].metricValue} errors found in ${data.essentials.alertTargetIDs}"
  }
}

Result: 7 errors found in ContosoApp.

This example shows a complete Resource Manager template that creates a Log search alert rule with a custom email subject titled “This is a custom email subject”.

{
  "___location": "eastus",
  "properties": {
    "description": "Performance rule",
    "severity": 4,
    "enabled": true,
    "evaluationFrequency": "PT5M",
    "scopes": [
      "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/scopeResourceGroup1/providers/Microsoft.Compute/virtualMachines/vm1"
    ],
    "windowSize": "PT10M",
    "criteria": {
      "allOf": [
        {
          "query": "Perf | where ObjectName == \"Processor\"",
          "timeAggregation": "Average",
          "metricMeasureColumn": "% Processor Time",
          "resourceIdColumn": "resourceId",
          "dimensions": [
            {
              "name": "ComputerIp",
              "operator": "Exclude",
              "values": [
                "192.168.1.1"
              ]
            },
            {
              "name": "OSType",
              "operator": "Include",
              "values": [
                "*"
              ]
            }
          ],
          "operator": "GreaterThan",
          "threshold": 70,
          "failingPeriods": {
            "numberOfEvaluationPeriods": 1,
            "minFailingPeriodsToAlert": 1
          }
        }
      ]
    },
    "muteActionsDuration": "",
    "actions": {
      "actionGroups": [
        "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/scopeResourceGroup1/providers/microsoft.insights/actiongroups/myactiongroup"
      ],
      "customProperties": {
        "key11": "value11",
        "key12": "value12"
      },
     "actionProperties": {
     "Email.Subject": "This is a custom email subject"
     }
    },
    "autoMitigate": true,
    "checkWorkspaceAlertsStorageConfigured": true,
    "skipQueryValidation": true
  }
}