Search & Filter Query Syntax
CloudQuery filter queries allow for quick searches of the asset inventory for cases when a full SQL would be too much overhead.
Last updated
Was this helpful?
CloudQuery filter queries allow for quick searches of the asset inventory for cases when a full SQL would be too much overhead.
Last updated
Was this helpful?
This page goes over the Asset Inventory search & query syntax and provides examples to set you up and running quickly.
Type a search query to find the categorized resources containing the searched value in one of their properties (table columns).
Examples
Return all categorized resources that are related to an IP address, such as an instance and the actual IP address resource.
Find an instance by name
Examples
Return assets where tags contains key service .
Return assets where tags contains a key that has the substringservice
Return assets where tags contains key service and value picture-service
Return assets where tags contains key "service" and pattern-match picture anywhere in the value.
You can use dot notation to search deep in nested JSON in JSON columns.
Examples
Find instances with public IP interface attachments (network_interfaces is a column in the aws_ec2_instances table).
Use backslash \ to escape special characters that have other meaning, such as asterisk * .
String values should be wrapped in double quotes.
Return assets where name is aws-mysql-db
Return assets where name is z1d.xlarge
Return assets where name begins with aws
Return assets where ebs_optimized is false
Return assets where instance_id is ID 123456789
Return assets where name does not begin with z1d
Return assets where ami_launch_index is greater than 5
Return assets where ami_launch_index is greater than or equal to 5
Return assets where ami_launch_index is less than 10
Return assets where ami_launch_index is less than or equal to 10
Return assets where name is aws-mysql-db AND ebs_optimized is false
Return assets where name is aws-mysql-db OR ebs_optimized is false
Return assets where name is not aws-mysql-db
Return assets where name is either aws-mysql-db OR aws-oracle-db, AND ebs_optimized is false
Return assets where region is either eu-west-1 OR us-east-1
Null and Empty operators can be used to check for empty values.
Null checks are applicable when the column type is int, string, boolean, or similar basic types (including JSON).
Empty checks are applicable when the column type is map, array, or similar container type.
Return assets where name is null
Return assets where name is NOT null
Return assets where tags is empty
Return assets where tags is NOT empty
Return assets where network_interface_ids contains a specific ID:
Return assets where network_interface_ids contains a pattern match:
Return assets where tags contains the value picture-service .
Return assets where tags contains a value that has the substringservice
Return assets where tags contains key service and value picture-service
Return assets where tags contains key "service" and pattern-match picture anywhere in the value.
Because tags are stored as a map type, you can use . You can also use this short-hand syntax to search for a tag with a specific key and value:
For shorthand syntax to use with tags, see .
