Turbot provides a powerful advanced query syntax to filter lists. The general model of interaction is standard, with specific fields and capability added to specific result sets.

Text filters

Text filters provide the simplest way to filter lists in Turbot, with simple text matching against appropriate fields (e.g. title, description). Beyond simple filters, text also supports the text:and in: operators for more specific commands.

Aim Filter text
Require foo foo
Exclude foo -foo
Require complex string "foo bar" or "foo's bar" or 'foo bar'
Exclude complex string -"foo bar"
Require foo or bar text:foo,bar
Require foo but exclude bar text:foo text:-bar
Require “foo bar” but exclude “foo’s bar” text:"foo bar" text:-"foo's bar"
Require foo in the title field foo in:title
No foo in the title field -foo in:title


Most Turbot lists support sorting by appropriate fields. Common examples would include titleurntimestamp.

Aim Filter text
Sort by field foo sort:foo
Reverse sort by field foo sort:-foo
Sort by field foo then bar sort:foo,bar
Sort by field foo, then reverse sort by bar sort:foo,-bar


Many Turbot lists are used to display resources from multiple levels of the resource hierarchy. For example, show all Control Alarms for an Account and it’s descendants.

Aim Filter text
Self only level:self
Descendants only level:descendant
Ancestors only level:ancestor
Self or Descendants level:self,descendant
All level:ancestor,self,descendant


Labels are used by many Turbot resources to allow grouping of similar capabilities. For example, aws/s3/bucket and security/encryption.

Aim Filter text
Require label foo label:foo
Exclude label foo label:-foo
Require label foo or bar label:foo,bar
Require labels foo and bar label:foo label:bar
Require label foo and exclude label bar label:foo label:-bar

Type (is)

Type filtering is highly specific to the list being filtered. It provides a simple way to filter on facts in the data. For example, controls support is:guardrail and is:stack while policies include support for is:orphanis:encrypted and more.

Aim Filter text
Require type foo is:foo
Exclude type foo is:-foo
Require type foo or bar type:foo,bar
Require types foo and bar type:foo type:bar
Require type foo and exclude type bar type:foo type:-bar


For advanced queries, Turbot supports match: filters which are applied against the final list of objects for very flexible rules. The match field expects a YAML string, which is parsed and applied to match the data (using lodash filter).

Aim Filter text
Field id must be foo match:"id: foo"


  • Accounts
    • cluster:mycluster
    • match:"id: test"
  • Controls
    • is:stack
    • is:guardrail
    • state:all
    • state:ok
    • sort:-timestamp - last update first
    • sort:stateChangedTimestamp - oldest alarm first
    • -tags in:subject - exclude controls that has tags in the subject field
  • Labels
    • id:aws/*
  • Policies
    • filter:important
    • label:aws/s3/bucket
    • is:orphan
    • is:exception
    • is:set
    • is:-set
  • Resource Groups
    • attachable:false
Was this article helpful?
0 out of 0 found this helpful