resource.type:Instance and instance: (type:t2.micro and state:stopped)
Query 1: This will return controls that have High criticality and the control result is Fail. A control is returned only when it matches both criteria.
control: (criticality:HIGH and result:FAIL)
Query 2: This will return all controls with High criticality and all controls with Fail result. A control is returned when it matches only one criteria.
control.criticality:HIGH and control.result:FAIL
Query 1: Entire shared key is "routetable.route" (preferred format)
routetable.route: (state:active and instanceOwnerId:aws-acct-joe)
Query 2: Partial shared key is "route"
routetable: (route.state:active and route.instanceOwnerId:aws-acct-joe)
This will return route tables with active state and vpc Id "vpc-2da7154b".
routetable: (route.state:active and vpcId:vpc-2da7154b)