Get the newest app or login log records
Returns the last lines lines of geometrikks.log or login.log as records, oldest first. It skips lines that do not parse, so fewer records can come back. App log records keep every key the event carried, so expect more keys than the schema lists.
session<token>Session cookie authentication.
lines?integerHow many lines to read from the end of the log, from 1 to 2000. The server clamps a value outside that range to the nearest end. Defaults to 500.
500source?stringapp reads geometrikks.log, login reads login.log. Defaults to app.
"app""app""login"Request fulfilled, document follows
application/json- response
The newest records of one log, oldest first.
records*array<>curl -X GET 'https://geometrikks.example.com/api/v1/logs/tail'{ "records": [ { "event": "string", "exception": "string", "ip": "string", "key": "string", "level": "string", "logger": "string", "timestamp": "string", "user": "string" } ]}Rotate the app and login logs now POST
Starts fresh log files and gzips the old ones into archives. It skips a log that is empty. Returns the names of the files that rotated. Needs a Read/write API key or a browser session.
Build an abuse report for an IP or an ASN GET
Returns what an abuse desk needs about one IP, or about the busiest IPs of one ASN, in the range: request counts, the busiest hour or day, the top paths and user agents, the newest log lines and CrowdSec data. Times are in UTC, and the raw access logs it reads go back ANALYTICS_RAW_RETENTION_DAYS days, 180 by default. The report leaves out the Host header, server name, referrer and remote user of each line, and the machine name and message of each alert. Your host names and public addresses become `[redacted]` in URLs and user agents. In a query string, the whole value of a parameter that names one of your hosts or carries a credential, such as `token` or `api_key`, also becomes `[redacted]`.