title: Azure Monitor Custom log search Query - understanding Period and Frequency
body: <p><strong>UPDATE</strong>:</p>
  
  <p>the actual problem is different from what I've described. I'll provide and update/edit to this ticket once we'll resolve the issue. More details may be found at this thread - <a href="https://techcommunity.microsoft.com/t5/Azure-Log-Analytics/Reliably-trigger-alerts-for-Log-Analytics-log-entries/m-p/319315/highlight/false#M1224" rel="nofollow noreferrer">https://techcommunity.microsoft.com/t5/Azure-Log-Analytics/Reliably-trigger-alerts-for-Log-Analytics-log-entries/m-p/319315/highlight/false#M1224</a></p>
  
  <p><strong>Original question</strong>:</p>
  
  <p>We use <code>Azure Monitor</code> to create alerts based on logs in <code>Log Analytics</code>. For this we choose our Log Analytics account as a "RESOURCE", then choose "Custom log search" signal name for "CONDITION". Alert logic - "Number of results greater than 0".</p>
  
  <p>Sample query:</p>
  
  <pre><code>search *
  | where ResourceProvider == "MICROSOFT.DATAFACTORY" and status_s == "Failed"
  </code></pre>
  
  <p>For <code>Period</code> and <code>Frequency</code> lets set <code>15</code> minutes. All looks simple, but...</p>
  
  <p><strong>The issue</strong>: described above setup does not work (it works <em>sometimes</em>), because alerts are fired only sometimes, a lot of them are missed which is completely unacceptable behavior.</p>
  
  <p>If we set <code>Period = Frequency = 5</code> minutes we basically miss almost every event. <code>Period = Frequency = 15</code> minutes works better, but still a lot of events are missing. <code>Period = Frequency = 30</code> works even better, but all this looks weird.</p>
  
  <p><strong>Important notice</strong> - logs are collected from <code>Data Factory V2</code> into <code>Log Analytics</code>. I suspect that alert misses are due to the fact that logs are delivered to <code>Log Analytics</code> with some delay (up to several minutes). So  when <code>Azure Monitor</code> evaluates alert query for the last <code>15</code> minutes (<code>Period=15</code>) it might be that most resent log entries are still not in <code>Log Analytics</code>. When next query evaluation is executed in <code>15</code> minutes <strong>it will miss the logs that were ingressed with a delay for prev <code>15</code> minutes interval</strong>. Is this assumption correct? If so, this is very weird - how then we supposed to configure <code>Period</code> and <code>Frequency</code> values? If I set <code>Period &gt; Frequency</code> (e.g. <code>Period = 30</code> and <code>Frequency = 5,</code> which means "evaluate expression every 5 minutes, take data for last 30 minutes from current time") then we get multiple duplicated alerts because <code>Period</code> is larger than <code>Frequency</code> so there is a big chance of log search query returning the same log entries every <code>5</code> minutes - this is highly undesirable behavior.</p>