--- title: "Query DNS logs" description: "Reference of key/value fields in Calico Cloud DNS activity logs in Elasticsearch, with guidance for building client and query lookups." product: "Calico Cloud" version: "v23.0.1" section: "Observability" canonical_url: "https://docs.tigera.io/calico-cloud/observability/elastic/dns/dns-logs" --- # Query DNS logs Calico Cloud pushes DNS activity logs to Elasticsearch, for DNS information that is obtained from [trusted DNS servers](https://docs.tigera.io/calico-cloud/network-policy/domain-based-policy.md#trusted-dns-servers). The following table details the key/value pairs in the JSON blob, including their [Elasticsearch datatype](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html). This information should assist you in constructing queries. | Name | Datatype | Description | | ------------------ | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `start_time` | date | When the collection of the log began in Unix timestamp format. | | `end_time` | date | When the collection of the log concluded in Unix timestamp format. | | `type` | keyword | This field contains one of the following values: ● `LOG`: Indicates that this is a normal DNS activity log. ● `UNLOGGED`: Indicates that this log is reporting DNS activity that could not be logged in detail because of [DNSLogsFilePerNodeLimit](https://docs.tigera.io/calico-cloud/reference/resources/felixconfig.md#spec). | | `count` | long | When `type` is: ● `LOG`: How many DNS lookups there were, during the log collection interval, with details matching this log. ● `UNLOGGED`: The number of DNS responses that could not be logged in detail because of [DNSLogsFilePerNodeLimit](https://docs.tigera.io/calico-cloud/reference/resources/felixconfig.md#spec). In this case none of the following fields are provided. | | `client_ip` | ip | The IP address of the client pod. A null value indicates aggregation. | | `client_name` | keyword | This field contains one of the following values: ● The name of the client pod. ● `-`: the name of the pod was aggregated. Check `client_name_aggr` for the pod name prefix. | | `client_name_aggr` | keyword | The aggregated name of the client pod. | | `client_namespace` | keyword | Namespace of the client pod. | | `client_labels` | array of keywords | Labels applied to the client pod. With aggregation, the label name/value pairs that are common to all aggregated clients. | | `qname` | keyword | The domain name that was looked up. | | `qtype` | keyword | The type of the DNS query (e.g. A, AAAA). | | `qclass` | keyword | The class of the DNS query (e.g. IN). | | `rcode` | keyword | The result code of the DNS query response (e.g. NoError, NXDomain). | | `rrsets` | nested | Detailed DNS query response data - see below. | | `servers` | nested | Details of the DNS servers that provided this response. | | `latency_count` | long | The number of lookups for which latency was measured. (The same as `count` above, unless some DNS requests were missed, or latency reporting is disabled - see `dnsLogsLatency` in the [FelixConfiguration resource](https://docs.tigera.io/calico-cloud/reference/resources/felixconfig.md).) | | `latency_mean` | long | Mean latency, in nanoseconds. | | `latency_max` | long | Max latency, in nanoseconds. | Each nested `rrsets` object contains response data for a particular name and a particular type and class of response information. Its key/value pairs are as follows. | Name | Datatype | Description | | ------- | ----------------- | ----------------------------------------------------------------------------------------------------------------------- | | `name` | keyword | The domain name that this information is for. | | `type` | keyword | The type of the information (e.g. A, AAAA). | | `class` | keyword | The class of the information (e.g. IN). | | `rdata` | array of keywords | Array of data, for the name, of that type and class. For example, when `type` is A, this is an array of IPs for `name`. | Each nested `servers` object provides details of a DNS server that provided the information in the containing log. Its key/value pairs are as follows. | Name | Datatype | Description | | ----------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ip` | ip | The IP address of the DNS server. | | `name` | keyword | This field contains one of the following values: ● The name of the DNS server pod. ● `-`: the DNS server is not a pod. | | `name_aggr` | keyword | This field contains one of the following values: ● The aggregated name of the DNS server pod. ● `pvt`: the DNS server is not a pod. Its IP address belongs to a private subnet. ● `pub`: the DNS server is not a pod. Its IP address does not belong to a private subnet. It is probably on the public internet. | | `namespace` | keyword | Namespace of the DNS server pod, or `-` if the DNS server is not a pod. | | `labels` | array of keywords | Labels applied to the DNS server pod or host endpoint; empty if there are no labels or the DNS server is not a pod or host endpoint. | The `latency_*` fields provide information about the latency of the DNS lookups that contributed to this log. For each successful DNS lookup Calico Cloud measures the time between when the DNS request was sent and when the corresponding DNS response was received. ## Query DNS log fields After a set of DNS logs has accumulated in Elasticsearch, you can perform many interesting queries. For example, if you query on: - `qname`, you can find all of the DNS response information that was provided to clients trying to resolve a particular domain name - `rrsets.rdata`, you can find all of the DNS lookups that included a particular IP address in their response data.