Azure / Azure/azure-cli-extensions

scheduled-query extension does not skip validation

Open
#6,204 3 comments 0 reactions 1 assignee Claimed by @AllyW View on GitHub
Auto-Assign Azure CLI Team customer-reported Monitor question Service Attention
Dominant language
Python
Stars
454
Forks
1.7k
Avg merge
2d 19h
Merged PRs (30d)
64

Description

### Related command
```
az monitor scheduled-query create
```
### Extension name (the extension in question)
scheduled-query

### Description of issue
When running the following command on a newly created keyvault:

```
QUERY='AzureDiagnostics | where clientInfo_s !contains "Go/go" | where OperationName == "SecretSet" or OperationName == "SecretGet" or OperationName == "SecretUpdate" or OperationName == "SecretDelete" or OperationName == "SecretPurge" | mv-expand parse_json(AdditionalFields) | extend User=AdditionalFields["identity_claim_unique_name"] | where User != "" | project TimeGenerated, User, OperationName, requestUri_s | sort by TimeGenerated desc'

az monitor scheduled-query create \
--name "Keyvault Access - ${keyvault_name}" \
--resource-group ${keyvault_resource_group} \
--scopes ${SQ_SCOPE} \
--description "Keyvault Access - ${keyvault_name}" \
--evaluation-frequency 1h \
--window-size 1h \
--severity 3 \
--skip-query-validation true \
--target-resource-type Microsoft.KeyVault/vaults \
--condition "count 'QRY1' > 0" \
--condition-query QRY1="${QUERY}"
```

I get the error:
'mvexpand' operator: Failed to resolve scalar expression named 'AdditionalFields'

Which is logical normally when the keyvault was just created. However, I have used the --skip-query-validation true flag, and it looks like the query is still getting validated.

It should completely skip validation and implement the alert rule.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.