使用Bicep创建Scheduled Query Rule时提示「必须指定查询」错误

尝试部署Scheduled Query Rule时收到以下错误：

[{"code":"InvalidRequestContent","message":"The request content was invalid and could not be deserialized: 'Query must be specified' Activity ID: 150e12f2-b2de-47ad-b3b7-4b5f1abf703c."}]

问题根源是你使用的Microsoft.Insights/scheduledQueryRules@2023-12-01 API版本，查询语句的配置位置不符合新版本的结构规范。该版本中，查询逻辑不再放在source节点下，而是需要整合到criteria.allOf的条件定义中。

修正后的Bicep代码 #

resource alert 'Microsoft.Insights/scheduledQueryRules@2023-12-01' = {
  name: alertRuleName
  location: location
  properties: {
    description: 'Alert when Event Grid diagnostics show any failures'
    enabled: true
    criteria: {
      allOf: [
        {
          query: 'AzureDiagnostics | where ResourceType == \"EVENTGRIDTOPICS\" | where Category in (\"PublishFailures\", \"DeliveryFailures\") | where TimeGenerated > ago(5m)'
          dataSourceId: workspace.id
          queryType: 'ResultCount'
          threshold: 0
          thresholdOperator: 'GreaterThan'
          timeAggregation: 'Count'
        }
      ]
    }
    severity: 2
    evaluationFrequency: 'PT5M'
    windowSize: 'PT5M'
    scopes: [
      workspace.id
    ]
    actions: {
      actionGroups: [
        actionGroup.id
      ]
    }
    autoMitigate: true
  }
}

关键修正说明 #

• 移除原代码中的source节点，将query、dataSourceId、queryType等查询相关参数移至criteria.allOf的条件对象内，这是新版本API要求的必填配置位置
• 删除冗余的schedule节点，因为evaluationFrequency和windowSize已经定义了相同的评估频率与时间窗口，无需重复配置

调整后部署即可正确识别查询语句，解决报错问题。

内容的提问来源于stack exchange，提问作者atamata