Change Queries

Change queries retrieve the audit trail of modifications to configuration items.

Query Properties

Property	Type	Description
types	array	Config types to get changes for
search	string	Free text search (supports change_type= and @order= prefixes)
tagSelector	string	Filter by tags of the affected config items
severity	string	Filter by severity (info, warning, critical)
agent	string	Filter by specific agent
limit	integer	Maximum changes to return

Example

pipelines.yaml
apiVersion: mission-control.flanksource.com/v1
kind: View
metadata:
  name: pipelines
  namespace: mc
spec:
  display:
    title: Pipelines
    icon: github
    sidebar: true
    table:
      sort: "-lastRun"
      size: 5
  cache:
    maxAge: 30m
    minAge: 1m
    refreshTimeout: 30s
  panels:
    - name: Repository
      type: table
      query: SELECT COUNT(*) AS value, details->'repository'->>'full_name' as repository FROM workflows GROUP BY details->'repository'->>'full_name'
    - name: Average Duration
      description: Create Release average duration
      type: duration
      query: >
        SELECT AVG(details->'duration') AS value, details->'repository'->>'full_name' as label
        FROM workflows GROUP BY details->'repository'->>'full_name'
  columns:
    - name: id
      type: string
      description: The id of the pipeline.
      primaryKey: true
      hidden: true
    - name: repository
      type: string
      description: The repository of the pipeline.
      width: "2"
      filter:
        type: multiselect
    - name: name
      type: string
      description: The name of the pipeline.
      width: "3"
      filter:
        type: multiselect
    - name: lastRun
      type: datetime
      description: The namespace name.
      width: "2"
    - name: lastRunBy
      type: string
      description: The chart name.
      width: "2"
      filter:
        type: multiselect
    - name: duration
      type: duration
      width: "1"
      description: The duration of the pipeline.
    - name: status
      type: status
      width: "1"
      description: The status of the pipeline.
      filter:
        type: multiselect
  queries:
    workflows:
      changes:
        limit: 10
        search: change_type=GitHubActionRun* @order=-created_at
        types:
          - GitHubAction::Workflow
  mapping:
    name: row.name.split('/')[1]
    lastRun: row.details.created_at
    lastRunBy: row.details.triggering_actor.login
    repository: row.details.repository.full_name
    status: >
      has(row.details.conclusion) ? row.details.conclusion : 'pending'
    duration: timestamp(row.details.updated_at) - timestamp(row.details.run_started_at)

Auto-Mapped Columns

Change queries provide these columns:

• id - Change identifier
• config_id, config_name, config_type - Affected resource
• change_type - Type of change (e.g., Created, Updated, Deleted)
• severity - Change severity
• summary - Human-readable summary
• details - Full change details (JSON)
• created_at - When the change was detected
• tags, labels - Tags/labels of the affected resource

Search Syntax

# Filter by change type
search: change_type=BackupSuccessful

# Ordering
search: '@order=-created_at'

# Combine
search: 'change_type=GitHubActionRun* @order=-created_at'