Log volume over time
Record counts per bucket and level, zero-filled. The bucket is chosen to keep at most 120 points unless bucket_seconds is given (at most 2,000 buckets).
curl -X GET "https://mythic-analytics.gulp.workers.dev/client/v1/logs/sparkline?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&bucket_seconds=42" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN"
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/client/v1/logs/sparkline?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&bucket_seconds=42"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
response = requests.get(url, headers=headers)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/logs/sparkline?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&bucket_seconds=42", {
method: "GET",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
)
func main() {
req, err := http.NewRequest("GET", "https://mythic-analytics.gulp.workers.dev/client/v1/logs/sparkline?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&bucket_seconds=42", nil)
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/logs/sparkline?location_id=example_string&from=2026-10-18T10%3A00%3A00Z&to=example_string&range=15m&levels=error%2Cfatal&services=checkout&q=timeout%20%22connection%20reset%22&attr=%5B%22http.status_code%3D500%22%5D&distinct_id=example_string&distinct_ids=user_42%2Cjane%40example.com&received_before=2026-10-18T11%3A00%3A00Z&session_id=example_string&trace_id=example_string&pattern_id=v1%3A892ea82429dfa0bf975caecb03a9e5ea&bucket_seconds=42')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
response = http.request(request)
puts response.body
{
"success": true,
"data": {
"bucket_seconds": 300,
"from": "2024-12-25T10:00:00Z",
"to": "2024-12-25T10:00:00Z",
"series": [
{
"bucket": "2024-12-25T10:00:00Z",
"total": 42,
"trace": 42,
"debug": 42,
"info": 42,
"warn": 42,
"error": 42,
"fatal": 42
}
]
}
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
/client/v1/logs/sparkline
Target server for requests. Edit to use your own host.
Agency key (ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.
ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.Location to scope to. Required for ak_ keys (or send the X-Location-Id header); ignored for sk_.
Window start, ISO 8601 or epoch milliseconds. Default is range (or 1 hour) before to.
Window end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. At most 30 days.
Comma list of levels.
Comma list of service names, at most 20.
Case-insensitive body search. Whitespace-separated terms must all match; double quotes keep a phrase. At most 5 terms.
Repeatable attribute filter, key=value or a bare key. Resource attributes are resource.<key>. At most 5.
Records linked to this distinct_id (from mythic.distinct_id, distinct_id, user.id or enduser.id).
Records linked to ANY of these distinct_ids: a comma list, or the param repeated. At most 50 values of at most 256 bytes. A value cannot contain a comma. To read one person's logs across all their identities, use GET /client/v1/data/people/{personId}/logs, which fills this in from the identity graph.
Only records Mythic accepted strictly before this instant (ISO 8601 or epoch milliseconds). Pins a read so that records arriving late cannot change it.
32 hex characters. A filter only.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Agency key (ak_) or location secret key (sk_). Scoped keys (mcp_) are accepted too and need logs:read. See Using an mcp_ key over HTTP.
Query Parameters
Location to scope to. Required for ak_ keys (or send the X-Location-Id header); ignored for sk_.
Window start, ISO 8601 or epoch milliseconds. Default is range (or 1 hour) before to.
2026-10-18T10:00:00ZWindow end, exclusive. Default now.
Preset window ending at to. Ignored when from is set. At most 30 days.
15m1h6h24h7d30dCase-insensitive body search. Whitespace-separated terms must all match; double quotes keep a phrase. At most 5 terms.
timeout "connection reset"Repeatable attribute filter, key=value or a bare key. Resource attributes are resource.<key>. At most 5.
["http.status_code=500"]Records linked to this distinct_id (from mythic.distinct_id, distinct_id, user.id or enduser.id).
Records linked to ANY of these distinct_ids: a comma list, or the param repeated. At most 50 values of at most 256 bytes. A value cannot contain a comma. To read one person's logs across all their identities, use GET /client/v1/data/people/{personId}/logs, which fills this in from the identity graph.
user_42,jane@example.comOnly records Mythic accepted strictly before this instant (ISO 8601 or epoch milliseconds). Pins a read so that records arriving late cannot change it.
2026-10-18T11:00:00Z32 hex characters. A filter only.
v1:892ea82429dfa0bf975caecb03a9e5ea