Filters & Queries

Once your cloud data is synced to CloudQuery Platform, there are two ways to find what you’re looking for. Filters give you a fast search bar in the Asset Inventory - type an IP address, instance ID, or structured query and get results across all your clouds. Queries give you full ClickHouse SQL in the SQL Console for joins, aggregations, and anything filters can’t express.

Filters

The Asset Inventory provides filters for finding resources by any attribute and an input for a full text search.

To filter resources by their properties, click the Filter by and select one of the properties, an operator, and the available values. You can add additional filters and change the logical operator (AND/OR) between them by clicking the logical operator in the input box.

To perform a full-text search, type your search query in the designated input.

The full text search input takes an arbitrary string and searches for its existence in the cloud resources and their metadata (including their JSON columns).

You can use logical operators in the full text search input as well. Use backslash \ to escape special characters that have other meaning, such as asterisk * .

Example full text search queries:

• "picture-service": finds all resources with the “picture-service” in one of the indexed columns.
• "picture-service" OR "auth-service": finds all resources with the “picture-service” or “auth-service” in one of the indexed columns.
• "test" AND NOT "latest": finds all resources with “test” but not containing “latest”.

Saved filters

Save filters for reuse by clicking Save after entering a filter expression. Saved filters can be:

• Reapplied from the saved filters panel in the Asset Inventory
• Used as scopes when creating policies
• Managed via the REST API

Queries

Queries are ClickHouse SQL statements you can run in the SQL Console. Queries can perform joins, aggregations, and complex conditions that go beyond what filters support.

For example, find all unassigned EC2 images by joining the aws_ec2_images table with the aws_ec2_instances table:

SELECT
    img.image_id,
    inst.image_id as ec2_image, -- should all be NULL to show unassigned
    img.name,
    img.creation_date,
    img.state,
    img.tags
FROM
    aws_ec2_images img
LEFT JOIN
    aws_ec2_instances inst ON inst.image_id = img.image_id
WHERE
    inst.image_id IS NULL -- AMIs not associated with any EC2 instance
    AND img.state = 'available'
    AND img.creation_date <= NOW() - INTERVAL 30 DAY
ORDER BY
    img.creation_date ASC;

Queries use ClickHouse SQL syntax. For more on saved queries, tagging, and alert integration, see the SQL Console documentation.

Insights uses the same filtering model to help you triage security, compliance, and cost findings. See Insights.

Next Steps

• Asset Inventory - browse, filter, and search your synced cloud resources
• SQL Console - run ClickHouse SQL queries against your synced data
• Policies - use saved filters as scopes for compliance policies
• Alerts - trigger alerts based on query results
• Query Examples - security, compliance, and FinOps query examples
• AI Query Writer - generate SQL queries using natural language