RQL Filter Query Syntax Error

HSoni_Northwell — Tue, 30 Jan 2024 15:16:40 GMT

I am testing few sample query with JOIN however running into multiple syntax errors.

I am trying match Azure NSG list and would like to know, if Azure VNET contain subnet with that specific NSG.

NSG -ID to match with VNET-Subnet array contains NSGID.

1,. Does Join works for single elements between X and Y or if there is single to multiple match between X and Y , along wiht Y with array match.

2. Does filter command needs left and right with variabl such as X.id ==Y.id or can it works X.id=="String"

3. Can we use filter with X.id == [array1][?any([properties].id 0] or similar?

Below query shows syntax error

config from cloud.resource where api.name = 'azure-network-nsg-list' AND json.rule = flowLogsSettings.enabled is false and id equals "AAAA" as X;

config from cloud.resource where api.name = 'azure-network-vnet-list' as Y;

filter '($.Y.id equals "BBBB")';

Re: RQL Filter Query Syntax Error

bpachauli — Thu, 11 Apr 2024 22:49:01 GMT

Hello @HSoni_Northwell please find the answers below:

1. The filter command is like a join. You need one element in X to match with at least one element in Y.

2. The filter command needs left and right variables to work correctly. Remember, it's a join.

3. The correct syntax should be in these lines - filter '$.X.<path_to_value> <operator> $.Y.<path_to_value>'
More on joins & RQLs can be found here - https://docs.prismacloud.io/en/classic/rql-reference/rql-reference/rql-faqs