Over 50 tested example queries organized by use case, from quick infrastructure counts to cross-system impact analysis

A curated collection of real-world ParaQL queries, organized by use case. Queries referencing specific CI types require the corresponding collector to be configured. Use SHOW TABLES to see which types are available in your environment. Examples are organized by the visualization they produce, making it easy to find a query that matches what you want to see.

Flagship Queries

These demonstrate ParaQL's core value: instant cross-system infrastructure intelligence that would otherwise require manual correlation across multiple tools.

Infrastructure Capacity Overview

See all sources at a glance with CI counts, relationships, and recent change activity:

SELECT source, COUNT(*) AS total_cis,
       SUM(relationship_count()) AS total_relationships,
       SUM(change_count(INTERVAL '7 days')) AS changes_this_week
FROM *
WHERE status = 'active'
GROUP BY source
ORDER BY total_cis DESC

Renders as a bar chart.

What Breaks If This Host Goes Down?

Determine the blast radius of a physical host failure:

SELECT name, ci_type, depth, path, criticality, criticality_score
FROM IMPACT(proxmox.node, name LIKE '%node%')
ORDER BY depth, criticality_score DESC

Renders as an impact graph with criticality coloring.

Full Infrastructure Stack

Walk from physical hardware through VMs to OS layers:

SELECT node.name, node.ci_type,
       vm.name, vm.ci_type,
       os.name, os.ci_type
FROM proxmox.node node
  <-[runs_on]- proxmox.vm vm
  <-[runs_on]- os.linux os

Renders as a multi-layer graph.

Stale Infrastructure Alert

Find CIs that haven't been seen recently (potential collection failures or decommissioned resources):

SELECT name, ci_type, source, last_seen,
       stale_for() AS staleness,
       criticality, relationship_count() AS rels
FROM *
WHERE last_seen IS STALE BY INTERVAL '4 hours'
  AND status = 'active'
ORDER BY criticality_score DESC, staleness DESC
LIMIT 50

Renders as a table.

Big Number Queries

Trigger: 1 row, 1 numeric column.

Total Active CIs

SELECT COUNT(*) AS active_cis
FROM *
WHERE status = 'active'

Running Pods

SELECT COUNT(*) AS running_pods
FROM kubernetes.pod
WHERE config.phase = 'Running'

Total vCPU Capacity

SELECT SUM(config.vcpus) AS total_vcpus
FROM openstack.instance
WHERE status = 'active'

Orphaned CI Count

SELECT COUNT(*) AS orphaned_cis
FROM ORPHANS()

Key-Value Queries

Trigger: 1 row, 2+ columns.

Single CI Profile

SELECT name, ci_type, source, status,
       age() AS ci_age, criticality,
       relationship_count() AS rels,
       change_count(INTERVAL '30 days') AS recent_changes
FROM kubernetes.pod
LIMIT 1

Cluster Summary

SELECT COUNT(*) AS total_nodes,
       SUM(config.vcpus) AS total_vcpus,
       AVG(config.ram_mb) AS avg_ram_mb,
       MIN(created_at) AS oldest_node,
       MAX(last_seen) AS last_collection
FROM openstack.instance
WHERE status = 'active'

Bar Chart Queries

Trigger: GROUP BY with non-time grouping.

CIs Per Source

SELECT source, COUNT(*) AS count
FROM *
WHERE status = 'active'
GROUP BY source
ORDER BY count DESC

Pods Per Namespace

SELECT namespace, COUNT(*) AS pod_count
FROM kubernetes.pod
WHERE config.phase = 'Running'
GROUP BY namespace
ORDER BY pod_count DESC

Criticality Distribution

SELECT criticality, COUNT(*) AS count
FROM *
WHERE status = 'active'
  AND criticality IS NOT NULL
GROUP BY criticality
ORDER BY count DESC

Relationship Types

SELECT relationship_type, COUNT(*) AS count
FROM relationships
WHERE status = 'active'
GROUP BY relationship_type
ORDER BY count DESC

Compute Capacity by Project

SELECT config.project_id, COUNT(*) AS instances,
       SUM(config.vcpus) AS total_vcpus,
       SUM(config.ram_mb) / 1024 AS total_ram_gb
FROM openstack.instance
WHERE status = 'active'
GROUP BY config.project_id
ORDER BY total_vcpus DESC

Line Chart Queries

Trigger: GROUP BY with time-like column.

Changes Over Time (Daily)

SELECT DATE_TRUNC('day', changed_at) AS day,
       COUNT(*) AS changes
FROM changes
WHERE changed_at > NOW() - INTERVAL '30 days'
GROUP BY DATE_TRUNC('day', changed_at)
ORDER BY day

Changes by Type Over Time

SELECT DATE_TRUNC('day', changed_at) AS day,
       change_type,
       COUNT(*) AS count
FROM changes
WHERE changed_at > NOW() - INTERVAL '14 days'
GROUP BY DATE_TRUNC('day', changed_at), change_type
ORDER BY day

CI Creation Rate

SELECT DATE_TRUNC('day', created_at) AS day,
       COUNT(*) AS new_cis
FROM *
WHERE created_at > NOW() - INTERVAL '30 days'
GROUP BY DATE_TRUNC('day', created_at)
ORDER BY day

Table Queries

Trigger: Multi-row results without aggregation.

Active Pods with Details

SELECT name, namespace, config.phase, config.node_name,
       config.qos_class, age() AS pod_age, last_seen
FROM kubernetes.pod
WHERE config.phase = 'Running'
ORDER BY namespace, name
LIMIT 50

Recent Changes with Field Details

SELECT ci_name, ci_type, change_type,
       field_name, old_value, new_value, changed_at
FROM changes
WHERE changed_at > NOW() - INTERVAL '24 hours'
ORDER BY changed_at DESC
LIMIT 100

Cross-System Search

SELECT name, ci_type, source, status, ip_addresses, fqdns
FROM *
WHERE name ILIKE '%web%'
   OR name ILIKE '%nginx%'
ORDER BY ci_type, name

DNS Zones

SELECT name, source, config.source_type,
       config.serial, config.record_count,
       last_seen
FROM dns.zone
ORDER BY name

Ceph OSD Status

SELECT name, source, config.osd_id,
       config.status, config.host,
       config.device_class, config.utilization
FROM ceph.osd
ORDER BY config.osd_id

Graph Queries

Trigger: Traversal without aggregation.

Deployment to Pod Mapping

SELECT dep.name, dep.ci_type,
       pod.name, pod.ci_type
FROM kubernetes.deployment dep
  -[manages]-> kubernetes.pod pod

Node Infrastructure Stack (Reverse Walk)

SELECT node.name, node.ci_type,
       vm.name, vm.ci_type,
       os.name, os.ci_type
FROM proxmox.node node
  <-[runs_on]- proxmox.vm vm
  <-[runs_on]- os.linux os

Service Dependencies

SELECT svc.name, svc.ci_type,
       pod.name, pod.ci_type
FROM kubernetes.service svc
  -[selects]-> kubernetes.pod pod

Any Relationship (Wildcard)

SELECT src.name, src.ci_type,
       tgt.name, tgt.ci_type
FROM kubernetes.deployment src
  -[*]-> * tgt
LIMIT 30

Variable-Depth Traversal

SELECT src.name, src.ci_type,
       tgt.name, tgt.ci_type
FROM proxmox.node src
  -[*1..3]-> * tgt
LIMIT 50

Schema Queries

Trigger: SHOW and DESCRIBE statements.

SHOW TABLES
SHOW TABLES FROM kubernetes
DESCRIBE kubernetes.pod
SHOW RELATIONSHIPS
SHOW RELATIONSHIPS FOR proxmox.node
SHOW TIERS
SHOW SOURCES

Explain Queries

Trigger: EXPLAIN prefix.

EXPLAIN SELECT name, config.phase
FROM kubernetes.pod
WHERE config.phase = 'Running'

EXPLAIN SELECT source, COUNT(*), SUM(change_count())
FROM *
WHERE status = 'active'
GROUP BY source

Diff Queries

Trigger: DIFF statement.

Kubernetes Pod Changes This Week

DIFF kubernetes.pod
BETWEEN NOW() - INTERVAL '7 days' AND NOW()

OpenStack Instance Changes This Month

DIFF openstack.instance
BETWEEN NOW() - INTERVAL '30 days' AND NOW()
ORDER BY name

Lineage Queries

Trigger: LINEAGE function.

Full Stack for a Pod

SELECT name, ci_type, tier, depth, direction
FROM LINEAGE(kubernetes.pod, name LIKE '%api%')

Node Lineage

SELECT name, ci_type, tier, depth, direction, relationship_type
FROM LINEAGE(proxmox.node)

Impact Queries

Trigger: Columns include depth, path, criticality.

Node Failure Impact

SELECT name, ci_type, depth, path, criticality, criticality_score
FROM IMPACT(proxmox.node, name LIKE '%node%')
ORDER BY depth, criticality_score DESC

Storage Failure Blast Radius

SELECT name, ci_type, depth, path, criticality, criticality_score
FROM IMPACT(ceph.pool)
ORDER BY criticality_score DESC
LIMIT 50

Advanced Language Features

DISTINCT

SELECT DISTINCT namespace
FROM kubernetes.pod
WHERE config.phase = 'Running'
ORDER BY namespace

HAVING

SELECT namespace, COUNT(*) AS pod_count
FROM kubernetes.pod
GROUP BY namespace
HAVING COUNT(*) > 5
ORDER BY pod_count DESC

IN Operator

SELECT name, ci_type, config.phase
FROM kubernetes.pod
WHERE config.phase IN ('Pending', 'Failed', 'Unknown')
ORDER BY config.phase, name

BETWEEN

SELECT ci_name, change_type, changed_at
FROM changes
WHERE changed_at BETWEEN NOW() - INTERVAL '48 hours' AND NOW()
ORDER BY changed_at DESC
LIMIT 50

Staleness Check

SELECT name, ci_type, source, last_seen,
       stale_for() AS staleness
FROM *
WHERE last_seen IS STALE BY INTERVAL '2 hours'
  AND status = 'active'
ORDER BY staleness DESC

Orphaned CIs (Detailed)

SELECT name, ci_type, source,
       age() AS ci_age, last_seen
FROM ORPHANS()
WHERE status = 'active'
ORDER BY ci_age DESC
LIMIT 30

COALESCE (NULL Handling)

SELECT name, ci_type,
       COALESCE(namespace, 'no-namespace') AS ns,
       COALESCE(criticality, 'unscored') AS crit
FROM *
WHERE status = 'active'
LIMIT 30

Raw JSONB Path Access

SELECT name, namespace,
       raw.metadata.labels AS labels,
       raw.spec.containers AS containers
FROM kubernetes.pod
WHERE config.phase = 'Running'
LIMIT 10

Arithmetic Expressions

SELECT name, config.vcpus,
       config.ram_mb,
       config.ram_mb / 1024 AS ram_gb,
       config.vcpus * 2 AS double_vcpus
FROM openstack.instance
WHERE status = 'active'
ORDER BY config.vcpus DESC

Temporal: AS OF

SELECT name, config.phase, config.node_name
FROM kubernetes.pod
AS OF NOW() - INTERVAL '7 days'
WHERE config.phase = 'Running'

Multi-Level Traversal with Filter

SELECT node.name, node.ci_type,
       vm.name, vm.ci_type,
       os.name, os.ci_type
FROM proxmox.node node
  <-[runs_on]- proxmox.vm vm
  <-[runs_on]- os.linux os

ParaQL Example Queries

On this page