Cloudflare operates multiple DNS services that handle over 100 billion queries per day for over 6 million internet properties. We collect and aggregate logs for these queries for customer analytics, DDoS attack analysis and ad-hoc debugging. Due to the scale at which we operate, we've had to be creative in our implementation. In this talk, I'll go into more detail on the architecture we use for log ingestion and insertion into a ClickHouse cluster, as well as how we aggregate the data over time for longevity. I'll also touch on the tools we use downstream of ClickHouse to visualize and analyze the data ad-hoc.