Query Readability and Format

Sifting through data can range from simple searches to complex queries. Reading, using, and/or reusing a query is easier if the query is written according to some basic recommendations.

Multi-line queries

Queries can be split over multiple lines by using the pipe operator as the break point, creating a chain of different expressions within. For example, the following query is functional:

logscale
#host=github #parser=json | repo.name=docker | groupBy(repo.name, function=count()) | sort()

However, while identical in result, this query is much easier to read:

logscale
#host=github #parser=json
| repo.name=docker
| groupBy(repo.name, function=count())
| sort()

Tip

Press Shift + Enter to insert a line break within the query.

Comments

The CrowdStrike Query Language (CQL) supports // single-line and /* multi-line */ comments.

Single-line comments should be used at the end of a line, for example:

logscale
#host=github #parser=json
| // Search for host and parser
repo.name=docker/*
| groupBy(repo.name, function=count())
| sort()

Multi-line comments are useful to provide a deeper description or documentation for a search. For example:

logscale
/* Search for killed processes
   Set the <signal> type and <process> name */
?{signal="*" }
| ?{process="*"}
| /Service exited due to (?<signal>\S+)/
| signal = ?signal
| /sent by (?<process>\S+)\[\d+\]/
| process = ?process