topic Re: Monaco: Deploy log monitoring rules without DQL format in Log Analytics

Monaco: Deploy log monitoring rules without DQL format

AntonPineiro — Fri, 18 Oct 2024 08:58:10 GMT

Hi,

I am deploying some log monitoring rules (processing, log events) and no problem using DQL matchers. But if I try syntax without DQL, it complains during deploy.

Do you know if we must use DQL syntax? We would like to deploy this configurations in some non Grail enabled tenants.

As an example:

Green line is working fine using DQL. But red line (logs classic) does not work. And that configuration was created in the UI without problems and it is literally what you get with "monaco download".

Were you in this situation before? Have you tried to deploy log monitoring confiurations, with Monaco, without DQL?

Best regards

Re: Monaco: Deploy log monitoring rules without DQL format

erh_inetum — Mon, 12 Aug 2024 06:14:05 GMT

Hi @AntonPineiro ,

Have you try this syntax?:

"query":"content=\\"ORA-\\"",

Regards,

Elena.

Re: Monaco: Deploy log monitoring rules without DQL format

AntonPineiro — Mon, 12 Aug 2024 08:15:18 GMT

Hi Elena,

Thank you so much! Yes, if fails also. It complains another thing, at least, it does not fail saying "DQL syntax not valid".

Best regards

Re: Monaco: Deploy log monitoring rules without DQL format

AntonPineiro — Fri, 16 Aug 2024 09:36:32 GMT

Syntax was correct but you need to be sure target tenant is not Grail enabled.

Tenant was Grail enabled (it was not expected) and it was failing for that. If Grail is enabled only DQL syntax is allowed. If not, LQL syntax will work perfectly.