Just a quick post to hopefully help other people with this error..
Long story short, we had a VSTS pipeline and code made by a guy few months ago, it was supposed to work. I did few changes and I had problems with the pipeline, fixed it and I finally was able to deploy. After few days of work it wasn’t working anymore.
I got a bunch of weird error like I wasn’t able to update the saved search, so I deleted them by hand which seems to fix this problem. But after that I got this weird error message which don’t say a lot of details about what is failing.
2019-06-08T01:41:44.9587130Z ##[error]At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details. 2019-06-08T01:41:44.9596749Z ##[error]Details: 2019-06-08T01:41:44.9597162Z ##[error]BadRequest: { "error": { "code": "BadRequest", "message": "Please validate the JSON payload." } } undefined
So as advised by one of my coworker I stopped using VSTS and try to deploy using powershell. It wasn’t working better, but yeah at least I got more details about the failing ressources.
Resource Microsoft.OperationalInsights/workspaces/savedSearches/schedules/actions XXXXXXXXXX
So at least now I knew what resources was concerned by this problem… After a lot of try I finally find out the query the guy wrote on few alerts wasn’t working. At least, it is not working anymore… So I removed the “| distinct RawData, Computer” and my deployment started working again.
Now the weird thing is it did work for a few times with this code.. At one time I fucked up the name of the alarm in prod vs nonprod and it looks like the problem started around this time but even after deleting all the saved search/solutions it was still failling…
So anyway it is working now, I hope someone will find this usefull and save them few hours of wasted time!