RQL Filter Query Syntax Error

[HSoni_Northwell]

I am testing few sample query with JOIN however running into multiple syntax errors.

I am trying match Azure  NSG  list  and  would like to know, if  Azure VNET contain subnet with that specific NSG. 

 NSG -ID to match with VNET-Subnet array contains NSGID.  

1,. Does Join  works for single elements between X and Y or if  there is single to multiple match between X and Y , along wiht Y with array match.

2. Does filter command needs left and right with variabl such as X.id ==Y.id or can it works X.id=="String"  

3. Can we use filter with X.id == [array1][?any([properties].id 0] or similar?

Below query shows syntax error

config from cloud.resource where api.name = 'azure-network-nsg-list' AND json.rule = flowLogsSettings.enabled is false and id equals "AAAA" as X;

config from cloud.resource where api.name = 'azure-network-vnet-list' as Y;

filter '($.Y.id equals "BBBB")';

[bpachauli]

Hello @HSoni_Northwell please find the answers below:

1. The filter command is like a join. You need one element in X to match with at least one element in Y.

2. The filter command needs left and right variables to work correctly. Remember, it's a join.

3. The correct syntax should be in these lines - filter '$.X.<path_to_value> <operator> $.Y.<path_to_value>'
More on joins & RQLs can be found here - https://docs.prismacloud.io/en/classic/rql-reference/rql-reference/rql-faqs