Heartbeat Alert is often something that you would configure to see if a VM has been not responding to azure for more than 5 minutes ( either a failure or a shutdown).
If you plan to monitor your servers but you have some that are test or either get shut down at night to save costs
You will need to Exception some servers from your Heartbeat alert in Log analytics to avoid raisin unnecessary alerts
here is how you would do it:
Last line is what it does the trick
Where “Computername1” is the server you wish to exception .
Once you are happy and tested the query . Make sure you update the Alert Rule
Alert Query:
Heartbeat
| where Computer !in (HeartbeatStopStartComputers)
| where TimeGenerated >= (datetime(2021-09-15T04:03:17.0000000Z) - 24h)
| extend Computer = replace(@"..*", @"", Computer)
| summarize LastHeartbeat = max(TimeGenerated) by Computer
| where LastHeartbeat < (datetime(2021-09-15T04:03:17.0000000Z) - 2h) and Computer != "Computername1" and Computer != "Computername2"
sevenitblog.com 