Learn more about Nested Queries
Best Practices
(1) Use nested queries when tokens have a shared key, in this example "instance".
resource.type:Instance and instance: (type:t2.micro and state:stopped)
(2) Consider the intent of your query.
Query 1: This will return controls that have High criticality and the control result is Fail. A control is returned only when it matches both criteria.
control: (criticality:HIGH and result:FAIL)
Query 2: This will return all controls with High criticality and all controls with Fail result. A control is returned when it matches only one criteria.
control.criticality:HIGH and control.result:FAIL
(3) When your query is nested, enter the entire shared key first for best results.
Query 1: Entire shared key is "routetable.route" (preferred format)
routetable.route: (state:active and instanceOwnerId:aws-acct-joe)
Query 2: Partial shared key is "route"
routetable: (route.state:active and route.instanceOwnerId:aws-acct-joe)
(4) Keep in mind a nested query (preferred format) will have shared key "routetable" in some cases.
This will return route tables with active state and vpc Id "vpc-2da7154b".
routetable: (route.state:active and vpcId:vpc-2da7154b)