I have set up a log-based alert in Microsoft Azure. The deployment of the alerts done via ARM template. Where you can input your query and set threshold like below.