List patterns
Records grouped by pattern: bodies that differ only in ISO dates, UUIDs, hex ids and numbers of 4 or more digits. Short numbers are kept, so status codes stay apart. new_only=1 keeps patterns with no record in the lookback_days before from and adds baseline, which says how much of that lookback the 30-day retention still covers.
curl -X GET "https://mythic-analytics.gulp.workers.dev/client/v1/logs/patterns?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&new_only=1&lookback_days=7&limit=50&offset=0" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/client/v1/logs/patterns?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&new_only=1&lookback_days=7&limit=50&offset=0"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.get(url, headers=headers)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/logs/patterns?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&new_only=1&lookback_days=7&limit=50&offset=0", {
method: "GET",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("GET", "https://mythic-analytics.gulp.workers.dev/client/v1/logs/patterns?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&new_only=1&lookback_days=7&limit=50&offset=0", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/logs/patterns?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&new_only=1&lookback_days=7&limit=50&offset=0')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
{
"success": true,
"data": {
"from": "2024-12-25T10:00:00Z",
"to": "2024-12-25T10:00:00Z",
"patterns": [
{
"pattern_id": "v1:892ea82429dfa0bf975caecb03a9e5ea",
"template": "order <num> placed for user 42",
"count": 10,
"errors": 42,
"first_seen": "2024-12-25T10:00:00Z",
"last_seen": "2024-12-25T10:00:00Z",
"service": "example_string",
"level": "example_string",
"services": 42,
"sample": {
"uuid": "example_string",
"body": "example_string"
}
}
],
"baseline": {
"baseline_from": "2024-12-25T10:00:00Z",
"baseline_to": "2024-12-25T10:00:00Z",
"retained_from": "2024-12-25T10:00:00Z",
"complete": true,
"covered_days": 3.14
}
}
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
/client/v1/logs/patterns
Target server for requests. Edit to use your own host.
Agency key (ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.
ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.Location to scope to. Required for ak_ keys (or send the X-Location-Id header); ignored for sk_.
Window start, ISO 8601 or epoch milliseconds. Default is range (or 1 hour) before to.
Window end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. At most 30 days.
Comma list of levels.
Comma list of service names, at most 20.
Case-insensitive body search. Whitespace-separated terms must all match; double quotes keep a phrase. At most 5 terms.
Repeatable attribute filter, key=value or a bare key. Resource attributes are resource.<key>. At most 5.
Baseline for new patterns.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Agency key (ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.
Query Parameters
Location to scope to. Required for ak_ keys (or send the X-Location-Id header); ignored for sk_.
Window start, ISO 8601 or epoch milliseconds. Default is range (or 1 hour) before to.
2026-10-18T10:00:00ZWindow end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. At most 30 days.
15m1h6h24h7d30dCase-insensitive body search. Whitespace-separated terms must all match; double quotes keep a phrase. At most 5 terms.
timeout "connection reset"Repeatable attribute filter, key=value or a bare key. Resource attributes are resource.<key>. At most 5.
["http.status_code=500"]1trueBaseline for new patterns.