Azure: Failed log alert deployment with ARM template

Question

I'm trying to create log alert rule using ARM template. The template is validated successfully, but deployment fails with quite unhelpful message:

{"status":"Failed","error":{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"InternalServerError","message":"{\r\n  \"error\": {\r\n    \"code\": \"ResourceDeploymentFailure\",\r\n    \"message\": \"The response for resource had empty or invalid content.\"\r\n  }\r\n}"}]}}

I tried with Portal and CLI, both ways result in the same error. This is the template I'm using (stripped of parameters for brevity):

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
    },
    "variables": {  },
    "resources": [
        {
            "name": "My new rule",
            "type": "Microsoft.Insights/scheduledQueryRules",
            "location": "germanywestcentral",
            "apiVersion": "2021-08-01",
            "tags": {},
            "properties": {
                "description": "Description",
                "severity": "3",
                "enabled": "true",
                "scopes": ["/subscriptions/###/resourceGroups/###/providers/microsoft.insights/components/###"],
                "evaluationFrequency":"PT5M",
                "windowSize": "PT5M",
                "criteria": {
                    "allOf": [
                        {
                            "query": "union \r\n    traces,\r\n    exceptions\r\n| where severityLevel > 2",
                            "metricMeasureColumn": "",
                            "resourceIdColumn": "",
                            "dimensions":[],
                            "operator": "GreaterThan",
                            "threshold" : "5000",
                            "timeAggregation": "Count",
                            "failingPeriods": {
                                "numberOfEvaluationPeriods": "1",
                                "minFailingPeriodsToAlert": "1"
                            }
                        }
                    ]
                },
                "actions": {
                    "actionGroups": "/subscriptions/###/resourcegroups/persevere/providers/microsoft.insights/actiongroups/my-action-group"
                }
            }
        }
    ]
}

Do you know what could be the failure reason here?

Answer 1

We have tested this in our local environment it is working fine. Below statements are based on our analysis.

When We have loaded the above shared template in our local environment(VS code), the intellisense of VScode showed couple of syntactical error .

After fixing all those error's we have tried deploying the template it got deployed successfully without any errors.

Here is the ARM template post fixing those syntactical errors :

{
   "$schema":"https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
   "contentVersion":"1.0.0.0",
   "parameters":{
      
   },
   "variables":{
      
   },
   "resources":[
      {
         "name":"My new rule",
         "type":"Microsoft.Insights/scheduledQueryRules",
         "location":"germanywestcentral",
         "apiVersion":"2020-05-01-preview",
         "tags":{
            
         },
         "properties":{
            "description":"Description",
            "severity":3,
            "enabled":true,
            "scopes":[
               "/subscriptions/xxxxxxxxx-xxx-xxx/resourceGroups/<RGName>/providers/microsoft.insights/components/<AppInsightsName>"
            ],
            "evaluationFrequency":"PT5M",
            "windowSize":"PT5M",
            "criteria":{
               "allOf":[
                  {
                     "query":"union \r\n traces,\r\n exceptions\r\n| where severityLevel > 2",
                     "metricMeasureColumn":"",
                     "resourceIdColumn":"",
                     "dimensions":[
                        
                     ],
                     "operator":"GreaterThan",
                     "threshold":5000,
                     "timeAggregation":"Count",
                     "failingPeriods":{
                        "numberOfEvaluationPeriods":1,
                        "minFailingPeriodsToAlert":1
                     }
                  }
               ]
            },
            "actions":[
               {
                  "actionGroupId":"/subscriptions/xxxxxxx-xxxx-xxx/resourceGroups/<RGName>/providers/microsoft.insights/actionGroups/<actiongroupName>"
               }
            ]
         }
      }
   ]
}

Here is the sample output Screenshot for reference:

Note: If you are using Visual Studio Code, to develop ARM templates we would suggest you to install the extension ARM Template Viewer which will help you in avoiding syntactical errors.