topic Re: Not getting any log alerts suddenly in Log Analytics

Not getting any log alerts suddenly

Sisapy09 — Fri, 09 May 2025 16:33:07 GMT

What could be the reason if the log alerts are not generating, and where should we start troubleshooting?
Tried test alert with content matching, not even showing in problems.
Is there a different way to set up monitoring if logs are ingested through a pipeline?

Re: Not getting any log alerts suddenly

yanezza — Sat, 05 Apr 2025 17:28:39 GMT

Hi!

When you mention log alerts, I assume you are referring to log events (Gen2). If an event isn't generated, you should first check the following:

Source Log Ingestion: Verify that the source log is ingested. You can check this using the Logs app.
Matcher Condition: Ensure that the matcher condition is matching. You can also use the Logs app to apply the same filter (switch to DQL mode and paste the matcher condition, adding a | filter pipe).

If the log is ingested and the condition is matched, please open a support ticket.

Re: Not getting any log alerts suddenly

Sisapy09 — Thu, 17 Apr 2025 04:10:59 GMT

my team migrated from classic pipeline to openpipeline. in new pipeline there were no data extraction conditions, so alerts stopped triggering.

Re: Not getting any log alerts suddenly

yanezza — Thu, 17 Apr 2025 07:46:56 GMT

In openpipeline there is a data extraction step, you can create a business event or a davis event (exactly like the old log event processing step)