Using JQ in Cortex

JQ is a lightweight, flexible command-line JSON processor.

Cortex leverages JQ within CQL to enable complex queries, including queries on YAML files. For instance:

jq(custom("foo"), ".property | length")

The above query would cycle through the foo object and retrieve the length of all .property components. This type of query is often used on Kubernetes resources.

JQ and datatypes

JQ can provide additional flexibility around data types. For instance, let's say you have a string associated with a numerical value in your Custom Data.

x-cortex-custom-metadata:
  my-key:
    line: "100"

If you wanted to query on the line value as a number rather than string, the following JQ functionality could be used within CQL:

jq(custom("my-key"), ".line | tonumber") > 99

This would result in the respective entity passing this CQL check.