Cloudwatch Logs PutLogEvents action fails with com.amazon.coral.service#UnknownOperationException when called from API Gateway

Question

I'm using API Gateway's AWS Service integration type to add logs to the Cloudwatch Logs service using the PutLogEvents action, as described here: https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutLogEvents.html

I've successfully setup a similar type of method to add items into a DynamoDB table using the PutItem action and that worked just fine, so I'm not sure what I'm missing with this one.

I've double checked for typos and problems with my template. Have successfully used PutLogEvents using the CLI tools, so the setup seems all OK.

Here's some screenshots of my setup from the AWS dash:

Here's the mapping template I'm using:

{
  "logGroupName": "FromAPI",
  "logStreamName": "$input.path('$.streamName')",
  "logEvents": [
    {
      "timestamp": $input.path('$.ts'), 
      "message": "$input.path('$.message')"
    }
  ]
}

The response I get back has a 200 status code, but the following response body:

{
  "Output": {
    "__type": "com.amazon.coral.service#UnknownOperationException",
    "message": null
  },
  "Version": "1.0"
}

Here's a redacted (xxx) execution log:

Execution log for request xxx
Fri Apr 19 02:28:58 UTC 2019 : Starting execution for request: xxx
Fri Apr 19 02:28:58 UTC 2019 : HTTP Method: POST, Resource Path: /log
Fri Apr 19 02:28:58 UTC 2019 : Method request path: {}
Fri Apr 19 02:28:58 UTC 2019 : Method request query string: {}
Fri Apr 19 02:28:58 UTC 2019 : Method request headers: {}
Fri Apr 19 02:28:58 UTC 2019 : Method request body before transformations: {
    "streamName": "12345",
    "ts": 1555641510000,
    "message": "help!"
}
Fri Apr 19 02:28:58 UTC 2019 : Endpoint request URI: https://logs.xxx.amazonaws.com/?Action=PutLogEvents
Fri Apr 19 02:28:58 UTC 2019 : Endpoint request headers: {Authorization=xxx, X-Amz-Date=20190419T022858Z, x-amzn-apigateway-api-id=xxx, Accept=application/json, User-Agent=AmazonAPIGateway_xxx, X-Amz-Security-Token=xxx [TRUNCATED]
Fri Apr 19 02:28:58 UTC 2019 : Endpoint request body after transformations: {
  "logGroupName": "FromAPI",
  "logStreamName": "12345",
  "logEvents": [
    {
      "timestamp": 1555641510000, 
      "message": "help!"
    }
  ]
}
Fri Apr 19 02:28:58 UTC 2019 : Sending request to https://logs.xxx.amazonaws.com/?Action=PutLogEvents
Fri Apr 19 02:28:58 UTC 2019 : Received response. Status: 200, Integration latency: 38 ms
Fri Apr 19 02:28:58 UTC 2019 : Endpoint response headers: {x-amzn-RequestId=xxx, Content-Type=application/json, Content-Length=105, Date=Fri, 19 Apr 2019 02:28:58 GMT}
Fri Apr 19 02:28:58 UTC 2019 : Endpoint response body before transformations: {"Output":{"__type":"com.amazon.coral.service#UnknownOperationException","message":null},"Version":"1.0"}
Fri Apr 19 02:28:58 UTC 2019 : Method response body after transformations: {"Output":{"__type":"com.amazon.coral.service#UnknownOperationException","message":null},"Version":"1.0"}
Fri Apr 19 02:28:58 UTC 2019 : Method response headers: {X-Amzn-Trace-Id=Root=xxx, Content-Type=application/json}
Fri Apr 19 02:28:58 UTC 2019 : Successfully completed execution
Fri Apr 19 02:28:58 UTC 2019 : Method completed with status: 200

Nothing gets logged into my Cloudwatch Logs stream - the API Gateway integration request response body contains an UnknownOperationException error.

My best guess is that this request is not mapping to the PutLogEvents action for some reason. Strange that the status code is 200 in this situation.

I'm guessing it's just some typo - or an additional header that I need to send through? Any ideas?

Answer 1

It should work if you add the following lines at the top of your Mapping Template:

#set($context.requestOverride.header['X-Amz-Target'] = "Logs_20140328.PutLogEvents")
#set($context.requestOverride.header['Content-Type'] = "application/x-amz-json-1.1")

This is very tricky and not well documented. You can find those headers in the sample request for PutLogEvents.