diff --git a/internal/db/models/ns_access_log_dao.go b/internal/db/models/ns_access_log_dao.go
index 5325c145..496cf851 100644
--- a/internal/db/models/ns_access_log_dao.go
+++ b/internal/db/models/ns_access_log_dao.go
@@ -112,7 +112,7 @@ func (this *NSAccessLogDAO) CreateNSAccessLogsWithDAO(tx *dbs.Tx, daoWrapper *NS
 }
 
 // ListAccessLogs 读取往前的 单页访问日志
-func (this *NSAccessLogDAO) ListAccessLogs(tx *dbs.Tx, lastRequestId string, size int64, day string, nodeId int64, domainId int64, recordId int64, reverse bool) (result []*NSAccessLog, nextLastRequestId string, hasMore bool, err error) {
+func (this *NSAccessLogDAO) ListAccessLogs(tx *dbs.Tx, lastRequestId string, size int64, day string, nodeId int64, domainId int64, recordId int64, keyword string, reverse bool) (result []*NSAccessLog, nextLastRequestId string, hasMore bool, err error) {
 	if len(day) != 8 {
 		return
 	}
@@ -122,18 +122,18 @@ func (this *NSAccessLogDAO) ListAccessLogs(tx *dbs.Tx, lastRequestId string, siz
 		size = 1000
 	}
 
-	result, nextLastRequestId, err = this.listAccessLogs(tx, lastRequestId, size, day, nodeId, domainId, recordId, reverse)
+	result, nextLastRequestId, err = this.listAccessLogs(tx, lastRequestId, size, day, nodeId, domainId, recordId, keyword, reverse)
 	if err != nil || int64(len(result)) < size {
 		return
 	}
 
-	moreResult, _, _ := this.listAccessLogs(tx, nextLastRequestId, 1, day, nodeId, domainId, recordId, reverse)
+	moreResult, _, _ := this.listAccessLogs(tx, nextLastRequestId, 1, day, nodeId, domainId, recordId, keyword, reverse)
 	hasMore = len(moreResult) > 0
 	return
 }
 
 // 读取往前的单页访问日志
-func (this *NSAccessLogDAO) listAccessLogs(tx *dbs.Tx, lastRequestId string, size int64, day string, nodeId int64, domainId int64, recordId int64, reverse bool) (result []*NSAccessLog, nextLastRequestId string, err error) {
+func (this *NSAccessLogDAO) listAccessLogs(tx *dbs.Tx, lastRequestId string, size int64, day string, nodeId int64, domainId int64, recordId int64, keyword string, reverse bool) (result []*NSAccessLog, nextLastRequestId string, err error) {
 	if size <= 0 {
 		return nil, lastRequestId, nil
 	}
@@ -197,6 +197,12 @@ func (this *NSAccessLogDAO) listAccessLogs(tx *dbs.Tx, lastRequestId string, siz
 				}
 			}
 
+			// keyword
+			if len(keyword) > 0 {
+				query.Where("(JSON_EXTRACT(content, '$.remoteAddr') LIKE :keyword OR JSON_EXTRACT(content, '$.questionName') LIKE :keyword OR JSON_EXTRACT(content, '$.recordValue') LIKE :keyword)").
+					Param("keyword", "%"+keyword+"%")
+			}
+
 			if !reverse {
 				query.Desc("requestId")
 			} else {
diff --git a/internal/rpc/services/nameservers/service_ns_access_log.go b/internal/rpc/services/nameservers/service_ns_access_log.go
index 4b455554..93677a79 100644
--- a/internal/rpc/services/nameservers/service_ns_access_log.go
+++ b/internal/rpc/services/nameservers/service_ns_access_log.go
@@ -50,7 +50,7 @@ func (this *NSAccessLogService) ListNSAccessLogs(ctx context.Context, req *pb.Li
 		// TODO
 	}
 
-	accessLogs, requestId, hasMore, err := models.SharedNSAccessLogDAO.ListAccessLogs(tx, req.RequestId, req.Size, req.Day, req.NsNodeId, req.NsDomainId, req.NsRecordId, req.Reverse)
+	accessLogs, requestId, hasMore, err := models.SharedNSAccessLogDAO.ListAccessLogs(tx, req.RequestId, req.Size, req.Day, req.NsNodeId, req.NsDomainId, req.NsRecordId, req.Keyword, req.Reverse)
 	if err != nil {
 		return nil, err
 	}