get_query_log
Retrieve Pi-hole DNS query logs with optional filters for domain, client, status, type, and time. Use it to troubleshoot DNS issues, audit blocked queries, or monitor client activity.
Instructions
Fetch DNS queries with optional filters (wildcards * supported on text filters).
Filters:
length: number of queries (default 100); start: offset for paging
from_ts / until_ts: Unix timestamps
domain, client_ip, client_name, upstream: exact or wildcard match
query_type: e.g. A, AAAA, HTTPS, PTR (unmapped types appear as TYPEnnn or OTHER)
status: e.g. GRAVITY, FORWARDED, CACHE, REGEX, DENYLIST
reply: e.g. IP, NXDOMAIN, NODATA, CNAME
dnssec: e.g. SECURE, INSECURE, BOGUS
cursor: cursor value from a previous response
disk: true searches the long-term database instead of in-memory queries Valid filter values come from get_query_suggestions.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| disk | No | ||
| reply | No | ||
| start | No | ||
| cursor | No | ||
| dnssec | No | ||
| domain | No | ||
| length | No | ||
| status | No | ||
| from_ts | No | ||
| until_ts | No | ||
| upstream | No | ||
| client_ip | No | ||
| query_type | No | ||
| client_name | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||