对于指标警报类型，搜索查询应包含“AggregatedValue”和“bin(TimeGenerated, [roundTo])”

如何解决对于指标警报类型，搜索查询应包含“AggregatedValue”和“bin(TimeGenerated, [roundTo])”

我想针对以下情况创建警报：

if (incoming_messages of event hub != outgoing_messages of event hub)
then I should get alerted

为此，我在日志分析中创建了一个查询，其中“比较”列显示了事件中心传入和传出消息的差异

但是当我使用下面的查询作为“指标测量”来创建警报时......它给出了以下错误

对于指标警报类型，搜索查询应包含“AggregatedValue”和“bin(TimeGenerated,[roundTo])”

有人可以告诉我如何解决这个错误，或者有没有其他方法可以为上述情况设置警报？？

这里是查询

let Incoming_Messages = AzureMetrics
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where _ResourceId contains "ResourceID-Hidden"
| where TimeGenerated > ago(1h)
| where MetricName contains "IncomingMessages"
| count | extend CommonCol="Dummy"
| project CommonCol,TotalIncomingMessages = Count;
let Outgoing_Messages = AzureMetrics
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where _ResourceId contains "ResourceID-Hidden"
| where TimeGenerated > ago(1h)
| where MetricName contains "OutgoingMessages"
| count | extend CommonCol="Dummy"
| project CommonCol,TotalOutgoingMessages = Count;
Incoming_Messages
| join Outgoing_Messages on CommonCol
| extend Comparison = TotalIncomingMessages - TotalOutgoingMessages
| project TotalOutgoingMessages,TotalIncomingMessages,Comparison

错误截图：

解决方法

在您的案例中使用“结果数”似乎更有意义。由于您想知道是否有任何行符合条件。

使用“结果数”（阈值 > 0）试试这个查询：

let Incoming_Messages = AzureMetrics
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where _ResourceId contains "ResourceID-Hidden"
| where TimeGenerated > ago(1h)
| where MetricName contains "IncomingMessages"
| count | extend CommonCol="Dummy"
| project CommonCol,TotalIncomingMessages = Count;
let Outgoing_Messages = AzureMetrics
| where ResourceProvider =="MICROSOFT.EVENTHUB"
| where _ResourceId contains "ResourceID-Hidden"
| where TimeGenerated > ago(1h)
| where MetricName contains "OutgoingMessages"
| count | extend CommonCol="Dummy"
| project CommonCol,TotalOutgoingMessages = Count;
Incoming_Messages
| join Outgoing_Messages on CommonCol
| extend Comparison = TotalIncomingMessages - TotalOutgoingMessages
| project TotalOutgoingMessages,TotalIncomingMessages,Comparison
| where Comparison != 0