Need Dimension Value PC in the teams Alert

Markus Schädlich 25

Hi ,

we want to send the alarm via a logic app to a teams channel.

The logic app was created like this:
https://zcusa.951200.xyz/de-de/azure/azure-monitor/alerts/alerts-logic-apps?tabs=send-email

this is the template:

User's image

This is the log analytics alert KQL:

InsightsMetrics
| where Name == 'FreeSpaceMB'
| summarize arg_max(TimeGenerated, *) by Tags, Computer
| extend Drive = tostring(parse_json(Tags)["vm.azm.ms/mountId"])
| extend Size = toreal(parse_json(Tags)["vm.azm.ms/diskSizeMB"])
| project TimeGenerated, Computer, Drive, bin(SizeGB = Size / 1024, 0.1), bin(FreeGB = Val / 1024, 1)
| join kind=inner (InsightsMetrics
    | where Name == "FreeSpacePercentage"
    | summarize arg_max(TimeGenerated, *) by Tags, Computer
    | extend Drive = tostring(parse_json(Tags)["vm.azm.ms/mountId"])
    | project TimeGenerated, Computer, Drive, bin(FreePercent = Val, 1.1))
on Computer, Drive
| project TimeGenerated, Computer, Drive, SizeGB, FreeGB, FreePercent
| order by Computer asc

The Problem is that we can only see the affected ressource log analytics workspace in the alert and not the pc which fired :

User's image

We need the information about the pc like this:

User's image

how can i add these informations to the logic app flow?

Pranay Reddy Madireddy 1,395 Reputation points Microsoft Vendor

2025-01-08T23:51:17.24+00:00

Hi Markus Schädlich

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

In your Logic App, go to the section where the alert is set up and check the properties included in the alert. To make the alert more informative, add the Computer property from the Kusto query output. This property will show the name of the PC that triggered the alert.

If you're using Azure Monitor alerts, you can change the alert template to show the Computer property. First, go to the Azure Monitor alert rule in the Azure portal. Click on "Actions" and then choose "Edit group notification template." In the template editor, add the expression {{triggerBody().Computer}} to include the PC name in your alert message. This will give you more detailed information in your notifications.

For reference, please review this documentation :-
https://zcusa.951200.xyz/en-us/azure/azure-monitor/alerts/alerts-overview?toc=%2Fazure%2Fmonitoring%2Ftoc.json
https://zcusa.951200.xyz/en-us/azure/azure-monitor/vm/monitor-virtual-machine-alerts

If you have any further queries, do let us know.

If the answer is helpful, please and "Upvote it".
Pranay Reddy Madireddy 1,395 Reputation points Microsoft Vendor

2025-01-09T17:27:18.69+00:00

Hi Markus Schädlich
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Markus Schädlich 25 Reputation points

2025-01-10T07:55:32.9966667+00:00

Hi Prana,

i see no "edit group notification themplate" when i select Actions in the log search alert rule
Pranay Reddy Madireddy 1,395 Reputation points Microsoft Vendor

2025-01-10T16:22:48.39+00:00
Hi Markus Schädlich
I apologize for the confusion. The option to edit the group notification template is available only for action groups and not for log search alert rules.
To add the PC information to the Logic App flow, you can change the Log Analytics alert rule to include the PC name in the alert details. Here’s an example query that shows the PC name:

InsightsMetrics | where Name == 'FreeSpaceMB' | summarize arg_max(TimeGenerated, *) by Tags, Computer | extend Drive = tostring(parse_json(Tags)["vm.azm.ms/mountId"]) | extend Size = toreal(parse_json(Tags)["vm.azm.ms/diskSizeMB"]) | project TimeGenerated, Computer, Drive, bin(SizeGB = Size / 1024, 0.1), bin(FreeGB = Val / 1024, 1) | join kind=inner (InsightsMetrics | where Name == "FreeSpacePercentage" | summarize arg_max(TimeGenerated, *) by Tags, Computer | extend Drive = tostring(parse_json(Tags)["vm.azm.ms/mountId"]) | project TimeGenerated, Computer, Drive, bin(FreePercent = Val, 1.1)) on Computer, Drive | project TimeGenerated, Computer, Drive, SizeGB, FreeGB, FreePercent, Computer | order by Computer asc

In this query, the Computer property is added to the project statement. This means that when the alert is triggered, the notification will show the PC name in the alert details.

If you have any further queries, do let us know.

If the answer is helpful, please and "Upvote it".

Share via

Need Dimension Value PC in the teams Alert

Your answer