
Google Cloud Firestore Query
CertifiedQuery documents from Firestore
Google Cloud Firestore Query
Query documents from Firestore
Executes a Firestore query with optional filters, ordering, pagination, and fetch mode. Supports fetching first/all rows or storing results to a file.
Each row carries the document ID in an _id field, unless the document already has its own _id field. A filter on _id matches that stored field, not the document ID.
type: io.kestra.plugin.gcp.firestore.QueryExamples
id: gcp_firestore_query
namespace: company.team
tasks:
- id: query
type: io.kestra.plugin.gcp.firestore.Query
collection: "persons"
filters:
- field: "lastname"
value: "Doe"
Installation
Our standard Docker images already include this plugin. If you use a -slim image or another setup, install it with the following command:
kestractl plugins get io.kestra.plugin:plugin-gcp --compatible-for $KESTRA_VERSION For kestractl, use your Kestra version with --compatible-for, or specify an exact plugin version.
For Kestra CLI, replace LATEST with a specific version or version range to pin the plugin version.
Properties
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150collection string
Collection path
Target collection name or path
databaseId string
(default)Database ID
Defaults to (default) if not provided
fetchType string
STORESTOREFETCHFETCH_ONENONEFetch type
FETCH_ONE returns first row; FETCH returns all rows in output; STORE writes rows to a file; NONE returns nothing.
filters array
Filters
List of field/operator/value filters applied as where clauses
A filter for the where clause
Field name for the filter
Field value for the filter
Field value for the filter. Only strings are supported at the moment.
EQUAL_TOEQUAL_TONOT_EQUAL_TOLESS_THANLESS_THAN_OR_EQUAL_TOGREATER_THANGREATER_THAN_OR_EQUAL_TOThe operator for the filter, by default EQUAL_TO that will call 'collection.whereEqualTo(name, value)'
impersonatedServiceAccount string
The GCP service account to impersonate
limit integerstring
Limit
Maximum number of results
offset integerstring
Offset
Start offset for paginating results
orderBy string
Order by field
orderDirection string
ASCENDINGASCENDINGDESCENDINGOrder direction
ASCENDING by default
projectId string
The GCP project ID
scopes array
["https://www.googleapis.com/auth/cloud-platform"]The GCP scopes to be used
serviceAccount string
The GCP service account
When unset or rendered to an empty value, Application Default Credentials are used (e.g. GOOGLE_APPLICATION_CREDENTIALS or the runtime's attached identity).
workloadIdentityAudience string
Audience of the Workload Identity Federation provider
The full resource name of the workload identity pool provider, //iam.googleapis.com/projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider>.
Required with workloadIdentityToken, and must match the aud claim of the token.
workloadIdentityToken string
OIDC token for Workload Identity Federation
When set together with workloadIdentityAudience, the token is exchanged at Google STS for federated credentials and no service account key is needed: Google verifies it against the identity provider that issued it.
Use {{ oidcToken(audience='…') }} to have Kestra Enterprise mint one for the running execution.
Combine with impersonatedServiceAccount to act as a service account the pool may impersonate, and set projectId explicitly since no key file carries it.
Cannot be combined with serviceAccount.
Outputs
row object
Map containing the first row of fetched data.
Only populated if using fetchType=FETCH_ONE.
rows array
List containing the fetched data.
Only populated if using fetchType=FETCH.
size integer
The number of fetched rows.
uri string
uriKestra's internal storage URI of the stored data.
Only populated if using fetchType=STORE.
Metrics
records counter
recordsNumber of records queried from the Firestore collection.