DataTugPull more from your data
Open app
☰

Learn with DataTug · English

Query Firestore with SQL

To query Firestore with SQL is the search people use when a document database will not take the language they already know. Firestore is Google's document database. SQL (Structured Query Language) is the language a relational database runs. A Firestore query tool in DataTug is the command-line interface (CLI), the datatug program in a terminal. TugQL is DataTug's query language. IAM (Identity and Access Management) is the Google permission check this connection uses. Firestore direct CLI queries have been available since release 0.125.1, which runs structured TugQL against Firestore and rejects SQL.

Run a structured query, not a SQL string

The source guide for this path is docs/sources/firestore.md at the CLI revision the supported databases catalogue cites. The command it shows is:

gcloud auth application-default login
datatug query run --db 'firestore://my-google-project/(default)' --from customers --no-policies --format json

Use firestore://PROJECT/DATABASE for a named database. Omitting /DATABASE selects (default). --from customers names one collection. It is not a SQL FROM clause, and the CLI will not accept one.

Application Default Credentials and a read-only role

Authentication uses Google Application Default Credentials, including GOOGLE_APPLICATION_CREDENTIALS when you set that variable. The Google identity needs Firestore read permission on the project and database you named. This is a server software development kit (SDK) connection governed by IAM. Firebase client Security Rules do not apply. Use an identity with read-only IAM permission when you only want to query. DataTug cannot reduce permissions that identity already has.

For a local emulator, the guide says to set FIRESTORE_EMULATOR_HOST=127.0.0.1:PORT and use a disposable project such as demo-datatug-firestore. The Google SDK then connects without production credentials. Do not set that variable for a production query.

Filters, order, limits, offsets, and cursors

The guide says filters, ordering, limits, offsets, and document cursors use the Firestore adapter in DALgo (Database Abstraction Layer for Go), the library DataTug uses for structured reads. Firestore indexes and the provider's own query limits still apply. The catalogue also lists windows among the structured operations. SQL, joins, projection aliases, computed projections, and aggregation are rejected. The guide names GROUP BY and HAVING among the unsupported SQL shapes.

Saved project catalogs use the driver name firestore and a connection descriptor whose path contains dsnEnv: DATATUG_FIRESTORE_SOURCE_URL. That environment variable holds the Firestore URL. Credentials stay outside project files.

Joins and writes are not this source

You cannot join Firestore to PostgreSQL or MySQL through this command. Cross-source TugQL joins are a different, CLI capability, and the Firestore guide says joins are unsupported on this source. The how-to for those two engines is join PostgreSQL and MySQL. Copying into Firestore and DALgo read-write transactions are rejected. Terminal browsing of Firestore that already existed is unchanged. Browser and hosted availability are not verified by the catalogue review.

Querying your Firestore database is separate from storage DataTug uses for itself. OVDB (OpenVaultDB) session storage describes one such boundary: investigation sessions mounted through OpenVaultDB (OVDB). That article is architecture in progress, not this query path. The URL in --db always selects the database you are querying.

--no-policies is an explicit opt-out

The sample command passes --no-policies. The guide calls that a trusted operator query. To enforce DataTug owner policies, configure --as and --role instead, as access policies describe for datatug query run. With no policy loaded and no --no-policies, that command refuses to run.

If you wanted SQL, start here

The SQL lessons teach joins and filters against the Chinook SQLite database. They do not run on Firestore. What is an MCP server is a separate question. The MCP server's published walkthrough is saved SQL on SQLite, not this Firestore command. Install the CLI from the installer. The current reviewed catalogue release is DataTug CLI 0.136.1; Firestore direct CLI queries have been available since DataTug CLI 0.125.1.