Search & Filter Query Syntax

CloudQuery filter queries allow for quick searches of the asset inventory for cases when a full SQL would be too much overhead.

This page goes over the Asset Inventory search & query syntax and provides examples to set you up and running quickly.

The Asset Inventory view, with search bar highlighted

Full-text Search

Type a search query to find the categorized resources containing the searched value in one of their properties (table columns).

Categorized resources are the resources that appear in one of the resource categories in the left side bar of Asset Inventory. Resources that appear only in the All Data are not indexed for the full-text search.

Examples

Return all categorized resources that are related to an IP address, such as an instance and the actual IP address resource.

18.222.7.254

Find an instance by name

cloudquery-platform-demo

Searching by Tags

Because tags are stored as a map type, you can use Array and Map operators. You can also use this short-hand syntax to search for a tag with a specific key and value:

tags.key = "value"

Examples

Return assets where tags contains key service .

tags.service != ""

Return assets where tags contains a key that has the substringservice

tags.*service* != ""

Return assets where tags contains key service and value picture-service

tags.service = "picture-service"

Return assets where tags contains key "service" and pattern-match picture anywhere in the value.

tags.service = "*picture*"

Searching in JSON columns

You can use dot notation to search deep in nested JSON in JSON columns.

Examples

Find instances with public IP interface attachments (network_interfaces is a column in the aws_ec2_instances table).

network_interfaces.*.Association.PublicIp != ""

Escaping special characters

Use backslash \ to escape special characters that have other meaning, such as asterisk * .

column = "value with \*"

Basic Comparison Operators

Equals (=, !=)

column = "value"

String values should be wrapped in double quotes.

Examples

Return assets where name is aws-mysql-db

name = "aws-mysql-db"

Return assets where name is z1d.xlarge

name = "z1d.xlarge"

Return assets where name begins with aws

name = "aws*"

Return assets where ebs_optimized is false

ebs_optimized = false

Return assets where instance_id is ID 123456789

instance_id = 123456789

Return assets where name does not begin with z1d

zone != z1d*

Greater Than, Equals (> , >=)

column > value

Examples

Return assets where ami_launch_index is greater than 5

ami_launch_index > 5

Return assets where ami_launch_index is greater than or equal to 5

ami_launch_index >= 5

Less Than, Equals (< , <=)

column < value

Examples

Return assets where ami_launch_index is less than 10

ami_launch_index < 10

Return assets where ami_launch_index is less than or equal to 10

ami_launch_index <= 10

Logical Operators

AND

expression1 AND expression2

Examples

Return assets where name is aws-mysql-db AND ebs_optimized is false

name = "aws-mysql-db" AND ebs_optimized = false

OR

expression1 OR expression2

Examples

Return assets where name is aws-mysql-db OR ebs_optimized is false

name = aws-mysql-db OR ebs_optimized = false

NOT

NOT expression

Examples

Return assets where name is not aws-mysql-db

NOT name = "aws-mysql-db"

Grouping ((...))

(expression1 OR expression2) AND expression3

Examples

Return assets where name is either aws-mysql-db OR aws-oracle-db, AND ebs_optimized is false

(name = "aws-mysql-db" OR name = "aws-oracle-db") AND ebs_optimized = false

Set Membership Operators

Includes (IN, NOT IN)

column IN (value1, value2, value3)

Examples

Return assets where region is either eu-west-1 OR us-east-1

region IN ("eu-west-1", "us-east-1")

Null and Empty Operators

Null and Empty operators can be used to check for empty values.

Null checks are applicable when the column type is int, string, boolean, or similar basic types (including JSON).

Empty checks are applicable when the column type is map, array, or similar container type.

Null (IS NULL, IS NOT NULL)

column IS NULL

Examples

Return assets where name is null

name IS NULL

Return assets where name is NOT null

name IS NOT NULL

Empty (IS EMPTY, IS NOT EMPTY)

column IS EMPTY

Examples

Return assets where tags is empty

tags IS EMPTY

Return assets where tags is NOT empty

tags IS NOT EMPTY

Array and Map Operators

Array Contains (CONTAINS)

column CONTAINS value

Examples

Return assets where network_interface_ids contains a specific ID:

network_interface_ids CONTAINS "69415778-d961-5161-9ee3-82d310d04089"

Return assets where network_interface_ids contains a pattern match:

network_interface_ids CONTAINS "69415778-*"

Map Contains (CONTAINS)

column CONTAINS value

column CONTAINS key:value

Examples

For shorthand syntax to use with tags, see Searching by Tags.

Return assets where tags contains the value picture-service .

tags CONTAINS picture-service

Return assets where tags contains a value that has the substringservice

tags CONTAINS *service*

Return assets where tags contains key service and value picture-service

tags CONTAINS service:picture-service

Return assets where tags contains key "service" and pattern-match picture anywhere in the value.

tags CONTAINS service:*picture*