CrowdStrike Query Language (CQL)

CrowdStrike Query Language (CQL) is a powerful, pipeline-based query language designed for searching, analyzing, and extracting insights from large volumes of log data- this provides a flexible approach to data exploration, combining pattern matching, data transformation, and visualization capabilities in a single query flow.

Unlike traditional query languages that prioritize structured data retrieval, CQL is optimized to work with both unstructured and semi-structured log data. Using a pipeline approach, data flows through a series of transformations, with each operation building on the results of the previous one. As a result, complex data analysis is more intuitive, allowing users to iteratively refine queries as they explore their data.

Key Features

CQL provides several powerful features for log analysis:

  • Pipeline-Based Processing: Using the pipe operator (|), data flows through transformations, making queries easy to read and build incrementally

  • Time-Series Focus: Built-in support for time-based operations, relative time expressions, and temporal correlation

  • Dynamic Schema: Fields can be extracted and created at query time without predefined schemas

  • Pattern Matching: Native support for regular expressions, glob patterns, and full-text search

  • Rich Function Library: Extensive set of functions for aggregation, transformation, formatting, and analysis

  • Integrated Visualization: Query results can be formatted as tables, charts, and other visualizations

Getting Started with CQL

This guide is organized to help you learn and use CQL effectively, whether you're new to LogScale or migrating from another query language:

  • Data Representation in LogScale: Understand the structure of events in LogScale, including fields, timestamps, and data types

  • Query Operation: Learn the fundamentals of query operations, including how queries execute and process data

  • Query Language Syntax: Explore CQL syntax, including filters, expressions, operators, and query structure

  • Function Operation: Master the extensive library of CQL functions for data manipulation and analysis

  • Datatypes in CQL: Understand data types in CQL and how values are interpreted and converted

  • Common Query Patterns: Find practical solutions for common query patterns and scenarios

  • Query Basics: Learn basic query patterns and techniques for everyday use

  • Query management: Discover how to save, organize, and reuse queries effectively

  • SQL to CQL: Transition your knowledge of SQL to CQL by exploring key differences and equivalent patterns

A CQL Example

This example query demonstrates a basic pipeline approach using CQL by searching for error events, grouping them by hostname, counting the occurrences, and sorting the results:

logscale
error=true
| groupBy(hostname, function=count(as=error_count))
| sort(error_count, order=desc)
| head(10)

Line by line, this query performs the following operations :

  1. Filters for events where error equals true

  2. Groups the results by hostname and counts the occurrences

  3. Sorts the results by error count in descending order

  4. Returns only the top 10 results

Each step builds on the previous one, making the query logic clear and easy to modify.

Recommended Learning Path

For those new to CQL, we recommend the following learning path:

  1. Start with basic concepts: Begin with Data Representation in LogScale to understand how data is structured, then move to Query Operation to learn how queries execute

  2. Learn the syntax: Work through Query Language Syntax to understand filters, expressions, and operators. Practice writing simple queries

  3. Explore functions: Review Function Operation to discover the functions available for your analysis needs

  4. Practice with patterns: Use Common Query Patterns to find solutions for common scenarios and learn practical techniques

  5. Master data types: Understand Datatypes in CQL to work effectively with different types of data

  6. Optimize your workflow: Learn Query management to save time by organizing and reusing your queries

Additional Resources

Beyond this guide, additional resources are available to help you master CQL:

  • Examples: The examples section provides practical, real-world query examples you can adapt to your needs Query Basics

  • Function Reference: Detailed documentation for each CQL function, including parameters, examples, and use cases Query Functions

  • Interactive Query Builder: The LogScale UI includes an interactive query builder that helps you construct queries and provides suggestions as you type

  • Community Resources: Join the CrowdStrike community to share queries, ask questions, and learn from other users