Search
Resoto comes with a powerful search engine.
It allows you to perform a full-text search to find resources without having to know the exact name of the property. You can filter results using powerful filter criterias and traverse the graph using graph traversals. Make sure to read how to sort and limit the results.
The result of a search can be aggregated, so valuable insights can be created from the underlying resource data.
Resoto allows for merging nodes, which can be a useful in case the information is not part of the node itself but in a reachable node nearby. It also allows filtering results with a certain graph structure using the with clause.
Full-Text Search
Each resource property value is indexed and searchable by Resoto. Full-text search criteria is always enclosed in double quotes.
Filters
Selecting Nodes by Kind
Sort and Limit
Every search result can be sorted by a number of fields. Sort order is either ascending (asc) or descending (desc). If no order is defined, the default is ascending. The syntax to define a sort is
Traversals
`` traverses the graph outbound.
Aggregation
There are several situations where specific data is not too relevant but needs lifting to a higher level. That is where aggregation comes into play. Aggregation allows grouping entities by one or more properties and then do math operations on that group.
Merging Nodes
While it is possible to search and retrieve a filtered part of the graph, it is sometimes helpful to retrieve structural graph data as part of the node.
with Clause
The with clause can be useful, in case you want to select elements and ensure a certain "position" in the graph, meaning that you want to make sure there are specific edges existent to specific other nodes.
Examples
Resoto's search syntax is quite powerful and has many features. We suggest trying some of the following searches to get a feel for Resoto's capabilities:
Searching Snapshots
You can search a specific Resoto Rewind asset inventory graph snapshot by prefixing a search with the graph=<graph-name> filter:
> graph=snapshot-resoto-hourly-20230618T210000Z search is(instance) | count
total matched: 12
total unmatched: 0
Alternatively, you can provide the --at flag to the search command to search at a specific point in time. Resoto will find the asset inventory graph snapshot that is closest to the specified time.
The --at flag takes either a timestamp or a relative time:
> search is(instance) --at 2023-06-18T21:00:00Z | count
total matched: 12
total unmatched: 0
> search is(instance) --at 1w | count
total matched: 12
total unmatched: 0
