Share via

Why is my payload empty when sending alert with log analytics using logic app to slack

Sai Kumar 0 Reputation points
2025-04-29T14:51:01.82+00:00

I have setup an alert in azure using log analytics and this is my KQL

ContainerAppConsoleLogs_CL
| where Log_s has "[E]"
| where TimeGenerated > ago(5m)
| extend ErrorType = extract(@"^\[E\](.*?){", 1, Log_s)
| summarize
    Count = count(),
    SampleLog = any(Log_s),
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated)
    by ErrorType, Source = "ConsoleLogs"
| extend
    AlertDescription = ErrorType,
    ErrorTypeText = strcat("*Error Type:*\n", ErrorType),
    SampleLogText = strcat("*Sample Log:*\n", replace_string(tostring(SampleLog), "\"", "\\\""))  // escape quotes
| extend SlackPayload = strcat("{",
    "\"text\": \"🚨 *Error Report*\",",
    "\"blocks\": [",
        "{",
            "\"type\": \"section\",",
            "\"fields\": [",
                "{ \"type\": \"mrkdwn\", \"text\": \"", ErrorTypeText, "\" },",
                "{ \"type\": \"mrkdwn\", \"text\": \"", SampleLogText, "\" }",
            "]",
        "}",
    "]",
"}")
| project AlertDescription, ErrorType, SampleLog, Source, Count, SlackPayload

I setup a logic app connected it with one of our slack channels. It was triggering a message but the payload is arriving as empty in slack. I setup the post message v2 to fetch the parameters such as the error log and the alert type.
User's image

It is coming empty handed into slack channel. No details on logs. Can anyone please help me on this.

Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
3,470 questions

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.