etag Property is not correctly recognized in Log Analytics Saved Search Bicep Resource Type.

[starkfell]

etag Property is not correctly recognized in Log Analytics Saved Search Bicep Resource Type.

[alex-frankel]

What are you using the etag property for? My understanding is that it is a read-only property used by ARM as a protection against concurrent write actions.

[starkfell]

When attempting to update an existing Saved Search Resource, the following error will occur without the etag property set:

Newer data exists in the Customer Configuration Store.

You can reference Stanislav Zhelyazkov's Article on how setting the etag property to [*] to resolve this issue:

Update saved search

[alex-frankel]

Interesting. Feels like an odd API behavior. @slavizh - any context you can share on this one?

Either way, this should not block the deployment, and we will tag it as an API spec issue.

[slavizh]

@alex-frankel I have not tried this RP with Bicep but as far as I have used the RP in ARM etag was required in order to work. If it is any workaround people should move to query packs - https://docs.microsoft.com/en-us/azure/azure-monitor/logs/query-packs. That API is modern and replaces the saved searches API. Overall I in generally ignore the warnings. Unfortunately most of them are caused by RP itself not Bicep. Of course I always log the warnings in this repo to make the team aware.

[iqoOopi]

The same "Newer data exists in the Customer Configuration Store." error when trying to deploy a savedSearches@2020-08-01
and can not add that etag thing

[iqoOopi]

@alex-frankel I have not tried this RP with Bicep but as far as I have used the RP in ARM etag was required in order to work. If it is any workaround people should move to query packs - https://docs.microsoft.com/en-us/azure/azure-monitor/logs/query-packs. That API is modern and replaces the saved searches API. Overall I in generally ignore the warnings. Unfortunately most of them are caused by RP itself not Bicep. Of course I always log the warnings in this repo to make the team aware.

Hi Alex, when I try to create the query via bicep query pack, it asks for a required field called name. The name has to be in guid format. I don't think this is correct. "name" is not documented https://learn.microsoft.com/en-us/azure/azure-monitor/logs/query-packs and if it is guid format then should be auto generated

[alex-frankel]

It is possible the name field requires a GUID. RoleAssignments is another resource type that has the same restriction. You can use the guid() function to generate a guid based on a seed of your choice (i.e. guid(resourceGroup().id, 'alfran')

[iqoOopi]

It is possible the name field requires a GUID. RoleAssignments is another resource type that has the same restriction. You can use the guid() function to generate a guid based on a seed of your choice (i.e. guid(resourceGroup().id, 'alfran')

If I run the template multiple times, will it create the same query multiple times as guild() generated different uuid each time.

[alex-frankel]

The guid is deterministic based on the seed (the function arguments)

[iqoOopi]

@alex-frankel Thanks Alex, was mixed guid with newGuid. Will try guid, thanks

[DataBach-maker]

Is there any update on this request?

[alex-frankel]

For the original issue, it sounds like the API is no longer recommended, but I will transfer to bicep-types for triage.

If your issue is with creating a Query Pack, I'd recommend opening a new Discussion.