From d202d51129d68a785fde32e2c43a0a1ae00f946a Mon Sep 17 00:00:00 2001 From: Alastair Lock Date: Mon, 8 Dec 2025 16:34:37 +0000 Subject: [PATCH] Update RE so it correctly patern matches The Regular Expression within the KQL was causing problems and resulted in the KQL reporting false positives. This PR updates the RE so it works correctly. It was not known why the formatting of the logs changed. --- infrastructure/modules/container-app-job/alerts.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/modules/container-app-job/alerts.tf b/infrastructure/modules/container-app-job/alerts.tf index a12a7fd9..b6e2609a 100644 --- a/infrastructure/modules/container-app-job/alerts.tf +++ b/infrastructure/modules/container-app-job/alerts.tf @@ -15,7 +15,7 @@ resource "azurerm_monitor_scheduled_query_rules_alert" "job_failure" { ContainerAppSystemLogs_CL | where JobName_s == "${azurerm_container_app_job.this.name}" | where Reason_s == "ProcessExited" - | extend ExitCode = toint(extract(@"exit code:\\s*(\\d+)", 1, Log_s)) + | extend ExitCode = toint(extract(@"exit code:\s*(\d+)", 1, Log_s)) | where ExitCode != 0 KQL severity = 1