如何将以双引号结尾的警报查询的值传递给ARM模板参数文件

Question

我正在使用 Azure 管道自动执行基于日志查询的警报。我首先将运行时参数值传递给 Azure 变量，然后使用管道中的替换令牌任务通过查询替换 parameter.json 文件。当我传递不以双引号结尾的查询时，ResourceGroup 部署任务成功。但是当我传递已经以双引号结尾的查询失败时。

例如：

这是我的基本查询。

"ApiManagementGatewayLogs
| where ApiId == ""my-api""
| where ResponseCode == 429
| where _SubscriptionId==""xxxxxxxxxxxxxxxxxxxxxxx"""

由于我的运行时参数是“字符串”类型，因此将其作为单行传递，如下所示

ApiManagementGatewayLogs| where ApiId == ""my-api""| where ResponseCode == 429| where _SubscriptionId==""xxxxxxxxxxxxxxxxxxxxxxx""

但是部署失败并出现以下错误

Template deployment validation was completed successfully.
Starting Deployment.
Deployment name is digitalAlerts
There were errors in your deployment. Error code: DeploymentFailed.
##[error]At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.
##[error]Details:
##[error]BadRequest: {
  "error": {
    "message": "The request had some invalid properties",
    "code": "BadArgumentError",
    "correlationId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "innererror": {
      "code": "SyntaxError",
      "message": "Request is invalid and cannot be processed: Syntax error: SYN0001: I could not parse that, sorry. [line:position=0:0]. Query: 'let ['ApiManagementGatewayLogs'] = view () { datatable(['TenantId']:string,['TimeGenerated']:datetime,['OperationName']:string,['CorrelationId']:string,['Region']:string,['IsRequestSuccess']:bool,['Category']:string,['TotalTime']:long,['CallerIpAddress']:string,['Method']:string,['Url']:string,['ClientProtocol']:string,['ResponseCode']:int,['BackendMethod']:string,['BackendUrl']:string,['BackendResponseCode']:int,['BackendProtocol']:string,['RequestSize']:int,['ResponseSize']:int,['Cache']:string,['CacheTime']:long,['BackendTime']:long,['ClientTime']:long,['ApiId']:string,['OperationId']:string,['ProductId']:string,['UserId']:string,['ApimSubscriptionId']:string,['BackendId']:string,['LastErrorElapsed']:long,['LastErrorSource']:string,['LastErrorScope']:string,['LastErrorSection']:string,['LastErrorReason']:string,['LastErrorMessage']:string,['ApiRevision']:string,['ClientTlsVersion']:string,['RequestHeaders']:dynamic,['ResponseHeaders']:dynamic,['BackendRequestHeaders']:dynamic,['BackendResponseHeaders']:dynamic,['RequestBody']:string,['ResponseBody']:string,['BackendRequestBody']:string,['BackendResponseBody']:string,['Errors']:dynamic,['TraceRecords']:dynamic,['SourceSystem']:string,['Type']:string,['_ResourceId']:string,['_SubscriptionId']:string)[] };restrict access to (*);\r\nApiManagementGatewayLogs\n| where ApiId == \\"my-api\\"\n| where ResponseCode == 429\n| where _SubscriptionId==\\"xxxxxxxxxxxxxxxxxxxxxxxx\\"\n\n'"
    }
  }
}
##[error]Check out the troubleshooting guide to see if your issue is addressed: https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-resource-group-deployment?view=azure-devops#troubleshooting
##[error]Task failed while creating or updating the template deployment.

正在寻找 2 个解决方案：

从管道端如何以与我的基本查询相同的格式传递查询，用户可以轻松地传递他们的查询，这将以正确的格式替换我的 parameters.json
其次，如何通过以双引号结尾的查询传递来避免上述问题。

请注意，已尝试通过将 " 替换为 / 来修改查询，但未解决问题

Answer 1

从问题中还不完全清楚，但听起来您正在通过 Azure DevOps 管道使用 ARM 模板部署类似 scheduled query rule 的东西。

由于 ARM 模板是一个 json 文档，任何字符串都需要用双引号引起来。但是，您传递的日志查询是用 Kusto 编写的，并且根据 Kusto 查询中的 docs 字符串，可以用单引号或双引号引起来。

如果您将查询重写为：

ApiManagementGatewayLogs | where ApiId == 'my-api'| where ResponseCode == 429 | where _SubscriptionId=='xxxxxxxxxxxxxxxxxxxxxxx'

它应该会成功。在您的 parameters.json 文件中，它看起来像这样：

{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "logQuery": {
            "value": "ApiManagementGatewayLogs | where ApiId == 'my-api'| where ResponseCode == 429 | where _SubscriptionId=='xxxxxxxxxxxxxxxxxxxxxxx'"
        }
     }
}

如何将以双引号结尾的警报查询的值传递给ARM模板参数文件

How to pass values of alert query ending with double quotes to ARM template parameter file

json

azure-devops

arm-template

azure-pipelines