# you can disable an alarm notification by setting the 'to' line to: silent

# ── Resource Utilization ────────────────────────────────────────────────────

 template: am_stream_analytics_su_utilization
       on: azure_monitor.stream_analytics.resource_utilization
    class: Utilization
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of su_memory
    units: percentage
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (75) : (80))
     crit: $this > (($status == $CRITICAL) ? (80) : (90))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics SU utilization on ${label:resource_name}
     info: Average streaming unit (memory) utilization of Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           Sustained high SU utilization indicates the job needs more streaming units.
       to: sysadmin

 template: am_stream_analytics_cpu_utilization
       on: azure_monitor.stream_analytics.resource_utilization
    class: Utilization
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of cpu
    units: percentage
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (75) : (80))
     crit: $this > (($status == $CRITICAL) ? (80) : (90))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics CPU on ${label:resource_name}
     info: Average CPU utilization of Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           High CPU indicates complex query processing or insufficient streaming units.
       to: sysadmin

# ── Watermark Delay ─────────────────────────────────────────────────────────

 template: am_stream_analytics_watermark_delay
       on: azure_monitor.stream_analytics.watermark_delay
    class: Latency
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of delay
    units: seconds
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (60)  : (120))
     crit: $this > (($status == $CRITICAL) ? (120) : (300))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics watermark delay on ${label:resource_name}
     info: Output watermark delay of Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           Growing delay means the job is falling behind processing input data.
       to: sysadmin

# ── Errors ──────────────────────────────────────────────────────────────────

 template: am_stream_analytics_runtime_errors
       on: azure_monitor.stream_analytics.errors
    class: Errors
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of runtime
    units: errors/s
    every: 1m
     warn: $this > (($status >= $WARNING) ? (0) : (1))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics runtime errors on ${label:resource_name}
     info: Runtime errors on Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           Runtime errors indicate issues with query execution or resource constraints.
       to: sysadmin

 template: am_stream_analytics_data_conversion_errors
       on: azure_monitor.stream_analytics.errors
    class: Errors
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of data_conversion
    units: errors/s
    every: 1m
     warn: $this > (($status >= $WARNING) ? (0) : (1))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics conversion errors on ${label:resource_name}
     info: Data conversion errors on Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           These occur when output events cannot be converted to the expected output schema.
       to: sysadmin

 template: am_stream_analytics_deserialization_errors
       on: azure_monitor.stream_analytics.errors
    class: Errors
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of deserialization
    units: errors/s
    every: 1m
     warn: $this > (($status >= $WARNING) ? (0) : (1))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics deserialization errors on ${label:resource_name}
     info: Input deserialization errors on Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           These occur when input events cannot be parsed (malformed JSON, CSV, Avro).
       to: sysadmin

# ── Event Timing ────────────────────────────────────────────────────────────

 template: am_stream_analytics_out_of_order_events
       on: azure_monitor.stream_analytics.event_timing
    class: Errors
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of out_of_order
    units: events/s
    every: 1m
     warn: $this > (($status >= $WARNING) ? (5) : (10))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics out-of-order events on ${label:resource_name}
     info: Rate of dropped or adjusted out-of-order events on Stream Analytics job \
           ${label:resource_name} in ${label:resource_group} (${label:region}). \
           High rates may indicate clock skew in event sources.
       to: sysadmin

 template: am_stream_analytics_late_events
       on: azure_monitor.stream_analytics.event_timing
    class: Errors
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of late
    units: events/s
    every: 1m
     warn: $this > (($status >= $WARNING) ? (5) : (10))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics late events on ${label:resource_name}
     info: Rate of late-arriving input events on Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           Late events arrive after the late arrival tolerance window.
       to: sysadmin

# ── Backlog ─────────────────────────────────────────────────────────────────

 template: am_stream_analytics_backlogged_events
       on: azure_monitor.stream_analytics.backlogged_events
    class: Utilization
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of backlogged
    units: events
    every: 1m
     warn: $this > (($status >= $WARNING)  ? (5000) : (10000))
     crit: $this > (($status == $CRITICAL) ? (10000) : (50000))
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics backlog on ${label:resource_name}
     info: Number of backlogged input events on Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region}). \
           A growing backlog means the job cannot keep up with the input rate.
       to: sysadmin

# ── Function Requests ───────────────────────────────────────────────────────

# Helper: total ML function request rate (used for minimum-data guard)
 template: am_stream_analytics_function_request_rate
       on: azure_monitor.stream_analytics.function_requests
    class: Workload
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of total
    units: requests/s
    every: 1m
  summary: Stream Analytics function call rate on ${label:resource_name}
     info: Average Azure ML function call rate for Stream Analytics job ${label:resource_name} \
           in ${label:resource_group} (${label:region})
       to: silent

 template: am_stream_analytics_function_failures
       on: azure_monitor.stream_analytics.function_requests
    class: Errors
     type: Other
component: Azure Stream Analytics
   lookup: average -5m unaligned of failed
     calc: ($am_stream_analytics_function_request_rate > 0) ? ($this * 100 / $am_stream_analytics_function_request_rate) : (0)
    units: %
    every: 1m
     warn: $this != nan AND ($am_stream_analytics_function_request_rate > 0.5) ? ($this > (($status >= $WARNING) ? (5) : (10))) : (0)
     crit: $this != nan AND ($am_stream_analytics_function_request_rate > 0.5) ? ($this > (($status == $CRITICAL) ? (15) : (25))) : (0)
    delay: down 5m multiplier 1.5 max 1h
  summary: Stream Analytics ML function failures on ${label:resource_name}
     info: Percentage of failed Azure ML function requests for Stream Analytics job \
           ${label:resource_name} in ${label:resource_group} (${label:region})
       to: sysadmin