Get a log digest
A summary of the window for an agent to read whole, at most 64 KB: totals by level, services, the top patterns, error and fatal patterns, and patterns new against the previous lookback_days. Every pattern carries its id, counts and one sample record (uuid and at most 2 KB of body). Default window 24 hours. truncated is true when lists were shortened to fit.
curl -X GET "https://mythic-analytics.gulp.workers.dev/client/v1/logs/digest?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&lookback_days=7" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/client/v1/logs/digest?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&lookback_days=7"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.get(url, headers=headers)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/logs/digest?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&lookback_days=7", {
method: "GET",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("GET", "https://mythic-analytics.gulp.workers.dev/client/v1/logs/digest?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&lookback_days=7", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/logs/digest?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&lookback_days=7')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
{
"success": true,
"data": {
"window": {
"from": "2024-12-25T10:00:00Z",
"to": "2024-12-25T10:00:00Z"
},
"generated_at": "2024-12-25T10:00:00Z",
"totals": {
"records": 42,
"by_level": {}
},
"services": [
{}
],
"top_patterns": [
{
"pattern_id": "v1:892ea82429dfa0bf975caecb03a9e5ea",
"template": "order <num> placed for user 42",
"count": 10,
"errors": 42,
"first_seen": "2024-12-25T10:00:00Z",
"last_seen": "2024-12-25T10:00:00Z",
"service": "example_string",
"level": "example_string",
"services": 42,
"sample": {
"uuid": "example_string",
"body": "example_string"
}
}
],
"error_patterns": [
{
"pattern_id": "v1:892ea82429dfa0bf975caecb03a9e5ea",
"template": "order <num> placed for user 42",
"count": 10,
"errors": 42,
"first_seen": "2024-12-25T10:00:00Z",
"last_seen": "2024-12-25T10:00:00Z",
"service": "example_string",
"level": "example_string",
"services": 42,
"sample": {
"uuid": "example_string",
"body": "example_string"
}
}
],
"new_patterns": [
{
"pattern_id": "v1:892ea82429dfa0bf975caecb03a9e5ea",
"template": "order <num> placed for user 42",
"count": 10,
"errors": 42,
"first_seen": "2024-12-25T10:00:00Z",
"last_seen": "2024-12-25T10:00:00Z",
"service": "example_string",
"level": "example_string",
"services": 42,
"sample": {
"uuid": "example_string",
"body": "example_string"
}
}
],
"new_patterns_baseline": {
"baseline_from": "2024-12-25T10:00:00Z",
"baseline_to": "2024-12-25T10:00:00Z",
"retained_from": "2024-12-25T10:00:00Z",
"complete": true,
"covered_days": 3.14
},
"truncated": true
}
}
/client/v1/logs/digest
Target server for requests. Edit to use your own host.
Agency key (ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.
ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.Location to scope to. Required for ak_ keys (or send the X-Location-Id header); ignored for sk_.
Window start, ISO 8601 or epoch milliseconds. Default is range (or 1 hour) before to.
Window end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. At most 30 days.
Comma list of levels.
Comma list of service names, at most 20.
Case-insensitive body search. Whitespace-separated terms must all match; double quotes keep a phrase. At most 5 terms.
Repeatable attribute filter, key=value or a bare key. Resource attributes are resource.<key>. At most 5.
Records linked to this distinct_id (from mythic.distinct_id, distinct_id, user.id or enduser.id).
Records linked to ANY of these distinct_ids: a comma list, or the param repeated. At most 50 values of at most 256 bytes. A value cannot contain a comma. To read one person's logs across all their identities, use GET /client/v1/data/people/{personId}/logs, which fills this in from the identity graph.
Only records Mythic accepted strictly before this instant (ISO 8601 or epoch milliseconds). Pins a read so that records arriving late cannot change it.
32 hex characters. A filter only.
Baseline for new patterns.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Agency key (ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.
Query Parameters
Location to scope to. Required for ak_ keys (or send the X-Location-Id header); ignored for sk_.
Window start, ISO 8601 or epoch milliseconds. Default is range (or 1 hour) before to.
2026-10-18T10:00:00ZWindow end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. At most 30 days.
15m1h6h24h7d30dCase-insensitive body search. Whitespace-separated terms must all match; double quotes keep a phrase. At most 5 terms.
timeout "connection reset"Repeatable attribute filter, key=value or a bare key. Resource attributes are resource.<key>. At most 5.
["http.status_code=500"]Records linked to this distinct_id (from mythic.distinct_id, distinct_id, user.id or enduser.id).
Records linked to ANY of these distinct_ids: a comma list, or the param repeated. At most 50 values of at most 256 bytes. A value cannot contain a comma. To read one person's logs across all their identities, use GET /client/v1/data/people/{personId}/logs, which fills this in from the identity graph.
user_42,jane@example.comOnly records Mythic accepted strictly before this instant (ISO 8601 or epoch milliseconds). Pins a read so that records arriving late cannot change it.
2026-10-18T11:00:00Z32 hex characters. A filter only.
v1:892ea82429dfa0bf975caecb03a9e5eaBaseline for new patterns.