Issue: while sending StartQuery to logs from API Gateway Integration

Question

I'm trying to send a StartQuery action to CloudWatch Logs API but all I get is  returned in the API Gateway Test console.  The purpose of the API gateway resource method is to query a specific log group with specific parameters.  The integration configuration seems to add `?Action=StartQuery` to the end of the url which I'm not sure is right.

I'm using AWS CDK.NET but also attempting to configure it in the Integration UI.

```
Thu Apr 10 13:31:52 UTC 2025 : Sending request to https://logs.eu-west-1.amazonaws.com/?Action=StartQuery
Thu Apr 10 13:31:52 UTC 2025 : Received response. Status: 200, Integration latency: 1 ms
Thu Apr 10 13:31:52 UTC 2025 : Endpoint response headers: {x-amzn-RequestId=634039bf-43d5-4d8b-8af5-93d05bc6a842, Content-Type=application/json, Content-Length=105, Date=Thu, 10 Apr 2025 13:31:52 GMT}
Thu Apr 10 13:31:52 UTC 2025 : Endpoint response body before transformations: {"Output":{"__type":"com.amazon.coral.service#UnknownOperationException","message":null},"Version":"1.0"}
Thu Apr 10 13:31:52 UTC 2025 : Method response body after transformations: {"Output":{"__type":"com.amazon.coral.service#UnknownOperationException","message":null},"Version":"1.0"}```

M Zubair Bin Ramzan · Answer

The  error typically indicates that the CloudWatch Logs API request is incorrectly formed, specifically that the operation you’re trying to invoke (in this case, StartQuery) is not being recognized by the service due to incorrect request parameters or URL structure.

Here's a breakdown of what might be causing the issue and how to fix it:

1. Invalid Query Parameter in the URL:
The URL in your request is:

ruby
Copy
Edit
https://logs.eu-west-1.amazonaws.com/?Action=StartQuery
AWS API Gateway expects the request to be structured according to the AWS CloudWatch Logs API format. The Action parameter is typically used for AWS SOAP API requests (which isn't applicable here).

Instead of using ?Action=StartQuery, the API call should use the appropriate HTTP method (POST) and proper parameters in the body of the request. The StartQuery operation is invoked through a POST request, not a GET request with URL parameters.

2. Correct Method:
The StartQuery operation should be invoked via the AWS CloudWatch Logs HTTP API. Typically, you'll send a POST request with the body containing the parameters for the query. The endpoint for this action should look like:

arduino
Copy
Edit
https://logs.eu-west-1.amazonaws.com
And you should include a properly structured request body for the StartQuery action, which might look something like this:

json
Copy
Edit
{
    "logGroupName": "your-log-group-name",
    "startTime": 1650180000000,
    "endTime": 1650183600000,
    "queryString": "fields @timestamp, @message | sort @timestamp desc | limit 20"
}
3. Check Integration Request Setup in API Gateway:
In the API Gateway console, you need to ensure that you're using the correct HTTP method (POST).

Ensure the query parameters (like Action=StartQuery) are not included in the URL. Instead, they should be part of the JSON body of the request (as shown in the example above).

Content-Type: Make sure that the Content-Type header is set to application/json.

4. IAM Role Permissions:
Ensure that the IAM role used by the API Gateway has the necessary permissions to call StartQuery on CloudWatch Logs. The role should have policies like:

{
    "Effect": "Allow",
    "Action": "logs:StartQuery",
    "Resource": "arn:aws:logs:region:account-id:log-group:your-log-group-name"
}
5. Response and Error Handling:
The UnknownOperationException error suggests that the API Gateway didn't recognize the operation. Double-check the integration settings to ensure you're correctly making the API request with the proper headers, body, and URL format.

Steps to Resolve:
Modify the Integration Request:
Ensure you're using POST for the HTTP method.
Make sure the request body includes the parameters needed for the StartQuery operation (logGroupName, startTime, endTime, and queryString).
Remove any extraneous query parameters (like Action=StartQuery).

Update the API Gateway Setup:
Verify that the method integration is set to use AWS service integration and ensure the URL points to https://logs..amazonaws.com.
Ensure the request body is formatted correctly with JSON payload.

IAM Role Permissions:
Confirm that the IAM role has the necessary permissions to call StartQuery.
After making these adjustments, test the API Gateway again. If the request is correctly formatted, it should return the expected response from the CloudWatch Logs API.

regards,
M Zubair
https://zeonedge.com

Issue: <UnknownOperationException/> while sending StartQuery to logs from API Gateway Integration

Relevant content