This topic describes the syntax of Record Relationship Navigation (RRN) queries.

The basic syntax for an RRN query is:

collection()/record[propertyKey1 = recordPath/propertyKey2]

where:

The forward slash (/) character is required between recordPath and propertyKey2 because propertyKey2 is a property step.

There are two ways to differentiate RRN queries from other types of EQL requests:

The following example illustrates a basic relationship filter query:

collection()/record[author_bookref =
	collection()/record[book_year = "1843"]/book_id]

In this example, the author_bookref is a property of Author records, which means that Author records are returned. These records are filtered by the book_year and book_id properties of the Book records. The author_bookref property is a reference to the book_id property (which is being used as the property step). Therefore, the query returns Author records for authors who wrote books that were published in 1843. There is an inner collection()/record function (which uses book_year as its property key) on the right side of the comparison expression.

The above query example is shown in a linear format. The query can also be made in a structured format, such as the following:

collection()/record
[
	author_bookref = collection()/record
	[
		book_year = "1843"
	]
	/book_id
]

This structured format will be used for most of the following examples, as it makes it easier to parse the query.

Relationship filter expressions work from the inside out (that is, the inner expressions are performed before the outer ones). In this example, the MDEX Engine first processes the Book records to come up with a set of Book records that have the book_year property set to “1843”. Then the book_id property values of the Book records provide a list of IDs that are used as indexes to filter the Author records (that is, as comparisons to the author_bookref property).