Skip to main content
JQ is a lightweight, flexible command-line JSON processor that allows users to do arbitrary JSON manipulations. Cortex leverages JQ within CQL to enable complex queries, including queries on YAML files. For instance:
The above query would cycle through the foo object and retrieve the length of all .property components. This type of query is often used on Kubernetes resources.

​
JQ and datatypes

JQ can provide additional flexibility around data types. For instance, let’s say you have a string associated with a numerical value in your Custom Data.
If you wanted to query on the line value as a number rather than string, the following JQ functionality could be used within CQL:
This would result in the respective entity passing this CQL check.

​
JQ examples

The following examples demonstrate ways you could use JQ in Cortex:

​
Use JQ to implement conditional logic for selecting file paths dynamically

This checks if custom git data exists, uses the custom dockerfile path if present, or falls back to the default “Dockerfile” path.

​
Accessing properties with special characters

Use bracket notation to access JSON properties containing dots, slashes, or other special characters:

​
Handling null values

Prevent errors by checking for null values before accessing properties:
For Scorecard rules, you can use a similar approach:

​
Wildcard pattern matching

Find packages containing specific strings using the matches() function:

​
Finding team members by role

Filter team members by role using JQ:

​
Handling complex YAML structures

When working with complex YAML files like GitLab CI configurations:

​
Extract the scheme of an AWS load balancer for resource metadata

Or, for nested metadata:

​
Extracting version from pom.xml file

This query extracts the version number from a Maven pom.xml file. You might use this to automate dependency version checks:

​
Display a parent entity name in a CQL report

This query would allow you to display a parent entity name value, rather than an array, in a CQL report: