Skip to Content
PlatformCore ConceptsFilters and Queries

Filters & Queries

Once your cloud data is synced to CloudQuery Platform, there are two ways to find what you’re looking for. Filters give you a fast search bar in the Asset Inventory - type an IP address, instance ID, or structured query and get results across all your clouds. Queries give you full ClickHouse SQL in the SQL Console for joins, aggregations, and anything filters can’t express.

Filters

The Asset Inventory supports a filter syntax for finding resources by any attribute. Type your search in the filter bar at the top of the Asset Inventory.

Search by any value (IP addresses, instance IDs, ARNs):

192.168.1.*
i-02f488a70bb73b315

The search index covers all categorized resources and their columns, including JSON columns. Searching an instance ID may also return attached interfaces or volumes that reference it.

You can write structured filters using a syntax similar to a SQL WHERE clause. For example, find an AWS EC2 instance by ARN:

resource_type = "aws_ec2_instances" AND arn = "arn:aws:ec2:us-east-1:586794438123:instance/i-09140f4e77f963973"

Unlike SQL, filters support wildcards with *. This filter finds all EC2 instances with an instance type starting with t:

resource_type = "aws_ec2_instances" AND instance_type = "t*"

This returns instances of type t2.micro, t3.medium, etc.

For the full syntax reference, see Search & Filter Query Syntax.

Saved filters

Save filters for reuse by clicking Save after entering a filter expression. Saved filters can be:

  • Reapplied from the saved filters panel in the Asset Inventory
  • Used as scopes when creating policies
  • Managed via the REST API

Queries

Queries are ClickHouse SQL statements you can run in the SQL Console. Queries can perform joins, aggregations, and complex conditions that go beyond what filters support.

For example, find all unassigned EC2 images by joining the aws_ec2_images table with the aws_ec2_instances table:

SELECT
    img.image_id,
    inst.image_id as ec2_image, -- should all be NULL to show unassigned
    img.name,
    img.creation_date,
    img.state,
    img.tags
FROM
    aws_ec2_images img
LEFT JOIN
    aws_ec2_instances inst ON inst.image_id = img.image_id
WHERE
    inst.image_id IS NULL -- AMIs not associated with any EC2 instance
    AND img.state = 'available'
    AND img.creation_date <= NOW() - INTERVAL 30 DAY
ORDER BY
    img.creation_date ASC;

Queries use ClickHouse SQL syntax. For more on saved queries, tagging, and alert integration, see the SQL Console documentation.

Insights uses the same filtering model to help you triage security, compliance, and cost findings. See Insights.

Next Steps

Last updated on
Data ModelAsset Inventory