Filter Query Syntax

CloudQuery filter queries allow for quick searches of the asset inventory for cases when a full SQL would be too much overhead.

CloudQuery Filters come in two flavors, Basic and Advanced, as shown in the UI below:

The asset inventory view, with the search bar highlighted.

This page goes over the custom query syntax and provides examples to get you up and running quickly. Filters can be saved, shared and can also be used in other parts of the platform, such as dashboards and alerts.

Basic Comparison Operators

Equals (=, !=)

column = value

String values can (optionally) be wrapped in double quotes. This is required when using a value that contains spaces.

Examples

Return assets where name is aws-mysql-db

name = aws-mysql-db

Return assets where name is z1d.xlarge

name = "z1d.xlarge"

Return assets where name begins with aws

name = aws*

Return assets where ebs_optimized is false

ebs_optimized = false

Return assets where instance_id is ID 123456789

instance_id = 123456789

Return assets where name does not begin with z1d

zone != z1d*

Greater Than, Equals (> , >=)

column > value

Examples

Return assets where ami_launch_index is greater than 5

ami_launch_index > 5

Return assets where ami_launch_index is greater than or equal to 5

ami_launch_index >= 5

Less Than, Equals (< , <=)

column < value

Examples

Return assets where ami_launch_index is less than 10

ami_launch_index < 10

Return assets where ami_launch_index is less than or equal to 10

ami_launch_index <= 10

Logical Operators

AND (AND)

expression1 AND expression2

Examples

Return assets where name is aws-mysql-db AND ebs_optimized is false

name = aws-mysql-db AND ebs_optimized = false

OR (OR)

OR is only available in Advanced query mode

expression1 OR expression2

Examples

Return assets where name is aws-mysql-db OR ebs_optimized is false

name = aws-mysql-db OR ebs_optimized = false

NOT (NOT)

NOT is only available in Advanced query mode

NOT expression

Examples

Return assets where name is not aws-mysql-db

NOT name = aws-mysql-db

Grouping ((...))

Grouping is only available in Advanced query mode

(expression1 OR expression2) AND expression3

Examples

Return assets where name is either aws-mysql-db OR aws-oracle-db, AND ebs_optimized is false

(name = aws-mysql-db OR name = aws-oracle-db) AND ebs_optimized = false

Set Membership Operators

Includes (IN, NOT IN)

column IN (value1, value2, value3)

Examples

Return assets where region is either eu-west-1 OR us-east-1

region IN (eu-west-1, us-east-1)

Null and Empty Operators

Null and Empty operators can be used to check for empty values.

Null checks are applicable when the column type is int, string, boolean, or similar basic types (including JSON).

Empty checks are applicable when the column type is map, array, or similar container type.

Null (IS NULL, IS NOT NULL)

column IS NULL

Examples

Return assets where name is null

name IS NULL

Return assets where name is NOT null

name IS NOT NULL

Empty (IS EMPTY, IS NOT EMPTY)

column IS EMPTY

Examples

Return assets where tags is empty

tags IS EMPTY

Return assets where tags is NOT empty

tags IS NOT EMPTY

Array and Map Operators

Array Contains (CONTAINS)

column CONTAINS value

Examples

Return assets where network_interface_ids contains a specific ID:

network_interface_ids CONTAINS "69415778-d961-5161-9ee3-82d310d04089"

Return assets where network_interface_ids contains a pattern match:

network_interface_ids CONTAINS "69415778-*"

Map Contains (CONTAINS)

column CONTAINS key

column CONTAINS key:value

Examples

Return assets where tags contains key service

tags CONTAINS service

Return assets where tags contains a key that has the substringservice

tags CONTAINS *service*

Return assets where tags contains key service and value picture-service

tags CONTAINS service:picture-service

Return assets where tags contains key "service" and pattern-match picture anywhere in the value.

tags CONTAINS service:*picture*