Skip to Content
ReferenceAPI referenceAccess Logs

List access log lines

GET
/api/v1/access-logs

Returns parsed access log lines, newest first, paged with currentPage and pageSize and sorted with orderBy and sortOrder. searchString matches part of the URL, referrer or user agent, ignoring case unless searchIgnoreCase is false. Timings are in seconds, and lines go back ANALYTICS_RAW_RETENTION_DAYS days, 180 by default. For recent polling, use window=10m and deduplicate by id. X-Range-Start and X-Range-End echo inclusive bounds; reuse them as fromTimestamp and toTimestamp on later pages. Do not send window with explicit bounds. Pagination is not a snapshot; overlapping polls can repeat records and do not guarantee late imports or backfills.

Authorization

cookiesession<token>

Session cookie authentication.

Query Parameters

currentPage?integer

The page to return, counted from 1. Defaults to 1.

Range1 <= value
Default1
pageSize?integer

Rows per page, from 1 to 1000. Defaults to 50.

Range1 <= value <= 1000
Default50
searchString?string|null
searchIgnoreCase?|
Defaulttrue
orderBy?string

The field to sort by, one of timestamp, id, ip_address, remote_user, method, url, http_version, status_code, bytes_sent, referrer, user_agent, request_time, upstream_response_time, host, country_code, country_name, city, autonomous_system_number, autonomous_system_organization, server, log_format. Defaults to timestamp, and any other value gets a 400. A sort by request_time or upstream_response_time puts lines without a timing last.

Default"timestamp"
sortOrder?string

asc or desc. Defaults to desc.

Default"desc"
Value in"asc""desc"
fromTimestamp?|

Keep only lines logged at or after this time, as ISO 8601 with a timezone.

toTimestamp?|

Keep only lines logged at or before this time, as ISO 8601 with a timezone.

window?|

A rolling window ending now, such as 15m, 24h or 7d, up to 365 days. Use positive whole minutes, hours or days. Cannot be combined with explicit time bounds.

methodIn?array<string>|

Keep only these HTTP methods, matched exactly, such as GET. Repeat the parameter to pass more than one.

ipAddressIn?array<string>|

Keep only these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.

cityIn?array<string>|

Keep only these cities, by the exact name GeoIP gives, such as Oslo. Repeat the parameter to pass more than one.

countryCodeIn?array<string>|

Keep only these countries, as uppercase two-letter ISO 3166-1 codes such as NO. Repeat the parameter to pass more than one.

statusIn?array<integer>|

Keep only these HTTP status codes, such as 404. Repeat the parameter to pass more than one.

ipAddressNotIn?array<string>|

Leave out these client IPs. Repeat the parameter to pass more than one. A value that is not an IP gets a 400.

hostIn?array<string>|

Keep only these Host header values, matched exactly, such as example.com. Repeat the parameter to pass more than one.

hostNotIn?array<string>|

Leave out these Host header values, matched exactly. Repeat the parameter to pass more than one. Lines without a host stay in.

serverIn?array<string>|

Keep only rows recorded under these server names. Repeat the parameter to pass more than one.

serverNotIn?array<string>|

Leave out rows recorded under these server names. Repeat the parameter to pass more than one. Rows without a server name stay in.

logFormatIn?array<string>|

Keep only lines read with these log formats, as /facets lists them, such as nginx. Repeat the parameter to pass more than one.

asnIn?array<integer>|

Keep only these autonomous system numbers, such as 13335. Repeat the parameter to pass more than one. Rows without ASN data are left out.

asnNotIn?array<integer>|

Leave out these autonomous system numbers. Repeat the parameter to pass more than one. Rows without ASN data stay in.

Response Body

Request fulfilled, document follows

application/json
  1. response

One page of results. total counts the matches on every page, limit is the page size and offset is how many matches come before this page.

items?array<>
limit?integer

Maximal number of items to send.

offset?integer

Offset from the beginning of the query.

total?integer

Total number of items.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/access-logs?fromTimestamp=2026-11-01T00%3A00%3A00Z&toTimestamp=2026-11-02T00%3A00%3A00Z'
Example Response
{  "items": [    {      "autonomousSystemNumber": 0,      "autonomousSystemOrganization": "string",      "bytesSent": 0,      "city": "string",      "countryCode": "string",      "countryName": "string",      "host": "string",      "httpVersion": "string",      "id": 0,      "ipAddress": "string",      "logFormat": "string",      "method": "string",      "referrer": "string",      "remoteUser": "string",      "requestTime": 0,      "server": "string",      "statusCode": 0,      "timestamp": "2019-08-24T14:15:22Z",      "upstreamResponseTime": 0,      "url": "string",      "userAgent": "string"    }  ],  "limit": 0,  "offset": 0,  "total": 0}

Count the stored raw log lines in a time range GET

Returns how many lines GeoMetrikks stored in the range, how many of them are malformed, and the most common parse error. The range filters on when GeoMetrikks stored each line, inclusive at both ends, and leaving out both ends counts every stored line. The list filters do not apply here.

List the filter values in the access logs GET

Returns every country, city, host, server name, log format and ASN the access logs hold, to fill the list filters. It reads the daily aggregates, so values stay listed after their raw lines are gone.