Over 50 tested example queries organized by use case — from quick infrastructure counts to cross-system impact analysis

A curated collection of real-world ParaQL queries, organized by use case. Queries referencing specific CI types require the corresponding collector to be configured — use SHOW TABLES to see which types are available in your environment. Examples are organized by the visualization they produce, making it easy to find a query that matches what you want to see.

Flagship Queries

These demonstrate ParaQL's core value — instant cross-system infrastructure intelligence that would otherwise require manual correlation across multiple tools.

Infrastructure Capacity Overview

See all sources at a glance with CI counts, relationships, and recent change activity:

SELECT source, COUNT(*) AS total_cis,
       SUM(relationship_count()) AS total_relationships,
       SUM(change_count(INTERVAL '7 days')) AS changes_this_week
FROM *
WHERE status = 'active'
GROUP BY source
ORDER BY total_cis DESC

Renders as a bar chart.

What Breaks If This Host Goes Down?

Determine the blast radius of a physical host failure:

SELECT name, ci_type, depth, path, criticality, criticality_score
FROM IMPACT(proxmox.node, name LIKE '%node%')
ORDER BY depth, criticality_score DESC

Renders as an impact graph with criticality coloring.

Full Infrastructure Stack

Walk from physical hardware through VMs to OS layers:

SELECT node.name, node.ci_type,
       vm.name, vm.ci_type,
       os.name, os.ci_type
FROM proxmox.node node
  <-[runs_on]- proxmox.vm vm
  <-[runs_on]- os.linux os

Renders as a multi-layer graph.

Stale Infrastructure Alert

Find CIs that haven't been seen recently — potential collection failures or decommissioned resources:

SELECT name, ci_type, source, last_seen,
       stale_for() AS staleness,
       criticality, relationship_count() AS rels
FROM *
WHERE last_seen IS STALE BY INTERVAL '4 hours'
  AND status = 'active'
ORDER BY criticality_score DESC, staleness DESC
LIMIT 50

Renders as a table.

Big Number Queries

Trigger: 1 row, 1 numeric column.

Total Active CIs

SELECT COUNT(*) AS active_cis
FROM *
WHERE status = 'active'

Running Pods

SELECT COUNT(*) AS running_pods
FROM kubernetes.pod
WHERE config.phase = 'Running'

Total vCPU Capacity

SELECT SUM(config.vcpus) AS total_vcpus
FROM openstack.instance
WHERE status = 'active'

Orphaned CI Count

SELECT COUNT(*) AS orphaned_cis
FROM ORPHANS()

Key-Value Queries

Trigger: 1 row, 2+ columns.

Single CI Profile

SELECT name, ci_type, source, status,
       age() AS ci_age, criticality,
       relationship_count() AS rels,
       change_count(INTERVAL '30 days') AS recent_changes
FROM kubernetes.pod
LIMIT 1

Cluster Summary

SELECT COUNT(*) AS total_nodes,
       SUM(config.vcpus) AS total_vcpus,
       AVG(config.ram_mb) AS avg_ram_mb,
       MIN(created_at) AS oldest_node,
       MAX(last_seen) AS last_collection
FROM openstack.instance
WHERE status = 'active'

Bar Chart Queries

Trigger: GROUP BY with non-time grouping.

CIs Per Source

SELECT source, COUNT(*) AS count
FROM *
WHERE status = 'active'
GROUP BY source
ORDER BY count DESC

Pods Per Namespace

SELECT namespace, COUNT(*) AS pod_count
FROM kubernetes.pod
WHERE config.phase = 'Running'
GROUP BY namespace
ORDER BY pod_count DESC

Criticality Distribution

SELECT criticality, COUNT(*) AS count
FROM *
WHERE status = 'active'
  AND criticality IS NOT NULL
GROUP BY criticality
ORDER BY count DESC

Relationship Types

SELECT relationship_type, COUNT(*) AS count
FROM relationships
WHERE status = 'active'
GROUP BY relationship_type
ORDER BY count DESC

Compute Capacity by Project

SELECT config.project_id, COUNT(*) AS instances,
       SUM(config.vcpus) AS total_vcpus,
       SUM(config.ram_mb) / 1024 AS total_ram_gb
FROM openstack.instance
WHERE status = 'active'
GROUP BY config.project_id
ORDER BY total_vcpus DESC

Line Chart Queries

Trigger: GROUP BY with time-like column.

Changes Over Time (Daily)

SELECT DATE_TRUNC('day', changed_at) AS day,
       COUNT(*) AS changes
FROM changes
WHERE changed_at > NOW() - INTERVAL '30 days'
GROUP BY DATE_TRUNC('day', changed_at)
ORDER BY day

Changes by Type Over Time

SELECT DATE_TRUNC('day', changed_at) AS day,
       change_type,
       COUNT(*) AS count
FROM changes
WHERE changed_at > NOW() - INTERVAL '14 days'
GROUP BY DATE_TRUNC('day', changed_at), change_type
ORDER BY day

CI Creation Rate

SELECT DATE_TRUNC('day', created_at) AS day,
       COUNT(*) AS new_cis
FROM *
WHERE created_at > NOW() - INTERVAL '30 days'
GROUP BY DATE_TRUNC('day', created_at)
ORDER BY day

Table Queries

Trigger: Multi-row results without aggregation.

Active Pods with Details

SELECT name, namespace, config.phase, config.node_name,
       config.qos_class, age() AS pod_age, last_seen
FROM kubernetes.pod
WHERE config.phase = 'Running'
ORDER BY namespace, name
LIMIT 50

Recent Changes with Field Details

SELECT ci_name, ci_type, change_type,
       field_name, old_value, new_value, changed_at
FROM changes
WHERE changed_at > NOW() - INTERVAL '24 hours'
ORDER BY changed_at DESC
LIMIT 100

Cross-System Search

SELECT name, ci_type, source, status, ip_addresses, fqdns
FROM *
WHERE name ILIKE '%web%'
   OR name ILIKE '%nginx%'
ORDER BY ci_type, name

DNS Zones

SELECT name, source, config.source_type,
       config.serial, config.record_count,
       last_seen
FROM dns.zone
ORDER BY name

Ceph OSD Status

SELECT name, source, config.osd_id,
       config.status, config.host,
       config.device_class, config.utilization
FROM ceph.osd
ORDER BY config.osd_id

Graph Queries

Trigger: Traversal without aggregation.

Deployment to Pod Mapping

SELECT dep.name, dep.ci_type,
       pod.name, pod.ci_type
FROM kubernetes.deployment dep
  -[manages]-> kubernetes.pod pod

Node Infrastructure Stack (Reverse Walk)

SELECT node.name, node.ci_type,
       vm.name, vm.ci_type,
       os.name, os.ci_type
FROM proxmox.node node
  <-[runs_on]- proxmox.vm vm
  <-[runs_on]- os.linux os

Service Dependencies

SELECT svc.name, svc.ci_type,
       pod.name, pod.ci_type
FROM kubernetes.service svc
  -[selects]-> kubernetes.pod pod

Any Relationship (Wildcard)

SELECT src.name, src.ci_type,
       tgt.name, tgt.ci_type
FROM kubernetes.deployment src
  -[*]-> * tgt
LIMIT 30

Variable-Depth Traversal

SELECT src.name, src.ci_type,
       tgt.name, tgt.ci_type
FROM proxmox.node src
  -[*1..3]-> * tgt
LIMIT 50

Schema Queries

Trigger: SHOW and DESCRIBE statements.

SHOW TABLES
SHOW TABLES FROM kubernetes
DESCRIBE kubernetes.pod
SHOW RELATIONSHIPS
SHOW RELATIONSHIPS FOR proxmox.node
SHOW TIERS
SHOW SOURCES

Explain Queries

Trigger: EXPLAIN prefix.

EXPLAIN SELECT name, config.phase
FROM kubernetes.pod
WHERE config.phase = 'Running'

EXPLAIN SELECT source, COUNT(*), SUM(change_count())
FROM *
WHERE status = 'active'
GROUP BY source

Diff Queries

Trigger: DIFF statement.

Kubernetes Pod Changes This Week

DIFF kubernetes.pod
BETWEEN NOW() - INTERVAL '7 days' AND NOW()

OpenStack Instance Changes This Month

DIFF openstack.instance
BETWEEN NOW() - INTERVAL '30 days' AND NOW()
ORDER BY name

Lineage Queries

Trigger: LINEAGE function.

Full Stack for a Pod

SELECT name, ci_type, tier, depth, direction
FROM LINEAGE(kubernetes.pod, name LIKE '%api%')

Node Lineage

SELECT name, ci_type, tier, depth, direction, relationship_type
FROM LINEAGE(proxmox.node)

Impact Queries

Trigger: Columns include depth, path, criticality.

Node Failure Impact

SELECT name, ci_type, depth, path, criticality, criticality_score
FROM IMPACT(proxmox.node, name LIKE '%node%')
ORDER BY depth, criticality_score DESC

Storage Failure Blast Radius

SELECT name, ci_type, depth, path, criticality, criticality_score
FROM IMPACT(ceph.pool)
ORDER BY criticality_score DESC
LIMIT 50

Advanced Language Features

DISTINCT

SELECT DISTINCT namespace
FROM kubernetes.pod
WHERE config.phase = 'Running'
ORDER BY namespace

HAVING

SELECT namespace, COUNT(*) AS pod_count
FROM kubernetes.pod
GROUP BY namespace
HAVING COUNT(*) > 5
ORDER BY pod_count DESC

IN Operator

SELECT name, ci_type, config.phase
FROM kubernetes.pod
WHERE config.phase IN ('Pending', 'Failed', 'Unknown')
ORDER BY config.phase, name

BETWEEN

SELECT ci_name, change_type, changed_at
FROM changes
WHERE changed_at BETWEEN NOW() - INTERVAL '48 hours' AND NOW()
ORDER BY changed_at DESC
LIMIT 50

Staleness Check

SELECT name, ci_type, source, last_seen,
       stale_for() AS staleness
FROM *
WHERE last_seen IS STALE BY INTERVAL '2 hours'
  AND status = 'active'
ORDER BY staleness DESC

Orphaned CIs (Detailed)

SELECT name, ci_type, source,
       age() AS ci_age, last_seen
FROM ORPHANS()
WHERE status = 'active'
ORDER BY ci_age DESC
LIMIT 30

COALESCE (NULL Handling)

SELECT name, ci_type,
       COALESCE(namespace, 'no-namespace') AS ns,
       COALESCE(criticality, 'unscored') AS crit
FROM *
WHERE status = 'active'
LIMIT 30

Raw JSONB Path Access

SELECT name, namespace,
       raw.metadata.labels AS labels,
       raw.spec.containers AS containers
FROM kubernetes.pod
WHERE config.phase = 'Running'
LIMIT 10

Arithmetic Expressions

SELECT name, config.vcpus,
       config.ram_mb,
       config.ram_mb / 1024 AS ram_gb,
       config.vcpus * 2 AS double_vcpus
FROM openstack.instance
WHERE status = 'active'
ORDER BY config.vcpus DESC

Temporal: AS OF

SELECT name, config.phase, config.node_name
FROM kubernetes.pod
AS OF NOW() - INTERVAL '7 days'
WHERE config.phase = 'Running'

Multi-Level Traversal with Filter

SELECT node.name, node.ci_type,
       vm.name, vm.ci_type,
       os.name, os.ci_type
FROM proxmox.node node
  <-[runs_on]- proxmox.vm vm
  <-[runs_on]- os.linux os

ParaQL Example Queries

On this page