能否用单条Azure Monitor告警规则覆盖所有严重级别？

针对重复创建3条近乎相同的告警规则、执行冗余查询的问题，可通过以下几种方案优化：

1. Terraform批量生成规则（减少代码冗余） #

通过for_each和变量定义，用一份代码批量生成3条规则，既保留独立规则的级别区分，又避免重复编写逻辑：

定义告警参数变量 #

variable "disk_space_alerts" {
  type = list(object({
    suffix          = string
    severity        = number
    filter_condition = string
  }))
  default = [
    {
      suffix          = "WARNING"
      severity        = 2
      filter_condition = "where CounterValue > 5 and CounterValue <= 10"
    },
    {
      suffix          = "ERROR"
      severity        = 1
      filter_condition = "where CounterValue > 1 and CounterValue <= 5"
    },
    {
      suffix          = "CRITICAL"
      severity        = 0
      filter_condition = "where CounterValue <= 1"
    }
  ]
}

批量生成告警资源 #

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "disk_space" {
  for_each         = { for alert in var.disk_space_alerts : alert.suffix => alert }
  name             = "VM Free Disk Space - ${each.value.suffix}"
  severity         = each.value.severity
  # 补充资源组、作用范围等固定配置
  criteria {
    threshold   = 0
    operator    = "GreaterThan"
    query       = <<-QUERY
      Perf
      | where TimeGenerated > ago(1h)
      | where ObjectName in~ ('LogicalDisk', 'Logical Disk') and CounterName =~ '% Free Space'  
      | where not (InstanceName in~ ("_Total" , "total" )) and not (InstanceName startswith "/snap")
      | summarize arg_max(TimeGenerated, CounterValue) by Computer, InstanceName, _ResourceId
      | project Computer, InstanceName, _ResourceId, CounterValue, TimeGenerated 
      ${each.value.filter_condition}
    QUERY
    # 补充criteria固定配置
  }
  # 补充其他资源固定配置
}

2. 单规则+维度拆分+动作组路由（减少查询次数） #

这是更高效的方案：只执行一次查询，通过维度拆分区分级别，再用动作组实现差异化通知：

编写带Severity维度的查询 #

Perf
| where TimeGenerated > ago(1h)
| where ObjectName in~ ('LogicalDisk', 'Logical Disk') and CounterName =~ '% Free Space'  
| where not (InstanceName in~ ("_Total" , "total" )) and not (InstanceName startswith "/snap")
| summarize arg_max(TimeGenerated, CounterValue) by Computer, InstanceName, _ResourceId
| project Computer, InstanceName, _ResourceId, CounterValue, TimeGenerated 
| where CounterValue <= 10
| extend Severity = case (
          CounterValue <= 1,  "Critical",
          CounterValue <= 5,  "Error",
          "Warning"
  )

配置告警规则的维度拆分 #

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "disk_space_unified" {
  name             = "VM Free Disk Space"
  severity         = 2 # 基础级别，后续通过维度区分
  # 补充资源组、作用范围等固定配置
  criteria {
    threshold   = 0
    operator    = "GreaterThan"
    query       = <<-QUERY
      # 上述带Severity维度的查询语句
    QUERY
    dimension {
      name     = "Severity"
      operator = "Include"
      values   = ["Critical", "Error", "Warning"]
    }
    # 补充criteria固定配置
  }
  # 补充其他资源固定配置
}

动作组按Severity路由通知 #

创建动作组时，针对不同Severity维度值配置差异化通知：比如Critical级触发电话+邮件，Error级仅邮件，Warning级仅日志记录。实现一次查询、多级别告警的效果。

3. 工作簿+自动化规则（进阶复杂场景） #

如果需要更灵活的逻辑，可：

• 创建Azure Monitor工作簿，定期执行磁盘空间查询并计算Severity；
• 通过Azure自动化规则，根据工作簿结果触发对应级别的告警。
  该方案复杂度较高，适合有定制化逻辑的场景。

内容的提问来源于stack exchange，提问作者JohnLBevan