AWS API Gateway

About

API Gateway access logs record every request a stage handles: caller IP, authenticated identity, route, status, latency, and authorizer or WAF errors. In Sazabi they show who calls which API, which requests fail authorization, and which clients are throttled or abusive. REST APIs can also write execution logs with authorizer and integration detail. API Gateway writes both kinds of log to CloudWatch Logs. Sazabi reads them through the same CloudWatch path as the AWS CloudWatch source.

Already connected your AWS account with the native AWS CloudWatch source? Turn on API Gateway logging (step 1), then pick the API Gateway log groups in that source’s log group list. You don’t need a collector.

Prerequisites

An API Gateway REST, HTTP, or WebSocket API
An OpenTelemetry Collector Contrib deployment, which ships the awscloudwatch receiver
AWS credentials for the collector with logs:DescribeLogGroups and logs:FilterLogEvents
Your Sazabi intake URL, shown above — open the log source and copy the Intake URL from its setup screen (the public key is embedded in the URL)

Set up in the dashboard

Turn on API Gateway logging

For each API stage, turn on access logging, send it to a CloudWatch log group whose name starts with API-Gateway-Access-Logs_, and use a JSON format. This format captures the fields most useful for security:

Access log format

{
  "requestId": "$context.requestId",
  "requestTime": "$context.requestTimeEpoch",
  "ip": "$context.identity.sourceIp",
  "userAgent": "$context.identity.userAgent",
  "caller": "$context.identity.caller",
  "user": "$context.identity.user",
  "principalId": "$context.authorizer.principalId",
  "httpMethod": "$context.httpMethod",
  "resourcePath": "$context.resourcePath",
  "status": "$context.status",
  "responseLatency": "$context.responseLatency",
  "authorizerError": "$context.authorizer.error",
  "wafResponseCode": "$context.wafResponseCode",
  "integrationStatus": "$context.integration.status"
}

For HTTP and WebSocket APIs, use $context.routeKey in place of $context.resourcePath.For REST APIs, also turn on execution logging at ERROR or INFO level on each stage. API Gateway writes execution logs to log groups whose names start with API-Gateway-Execution-Logs_. Execution logging needs a CloudWatch Logs role with the AmazonAPIGatewayPushToCloudWatchLogs policy, set once per region under API Gateway Settings.

Configure the collector

Add the awscloudwatch receiver and the Sazabi exporter to your collector configuration. Set region to the region your APIs run in; add one receiver per region.

otelcol.yaml

receivers:
  awscloudwatch/api-gateway:
    region: us-east-1
    logs:
      poll_interval: 1m
      groups:
        autodiscover:
          limit: 100
          prefix: API-Gateway-

exporters:
  otlphttp/sazabi:
    endpoint: <your intake URL>

service:
  pipelines:
    logs:
      receivers: [awscloudwatch/api-gateway]
      exporters: [otlphttp/sazabi]

If your access log groups use another name, list them under groups.named instead of autodiscover. The collector uses the standard AWS SDK credential chain; the credential stays with your collector and is never sent to Sazabi.

Deploy and send a request

Deploy the collector, then send a request to one of your APIs. Records appear after the next poll.

Other API gateways

Kong and Apigee don’t write to CloudWatch Logs. Send their logs to an OpenTelemetry Collector and connect that collector to Sazabi.

Kong
Apigee

Turn on Kong’s OpenTelemetry plugin and point its logs_endpoint at the collector’s OTLP/HTTP receiver. Kong Gateway 3.8 and later export request and plugin logs over OTLP.

kong.yaml

plugins:
  - name: opentelemetry
    config:
      logs_endpoint: http://otel-collector:4318/v1/logs
      resource_attributes:
        service.name: kong

otelcol.yaml

receivers:
  otlp:
    protocols:
      http:
        endpoint: 0.0.0.0:4318

service:
  pipelines:
    logs:
      receivers: [otlp]
      exporters: [otlphttp/sazabi]

Add a MessageLogging policy to your API proxies that sends syslog over TCP to the collector, and receive it with the syslog receiver from the contrib distribution.

MessageLogging policy

<MessageLogging name="Log-To-Collector">
  <Syslog>
    <Message>{"requestId":"{messageid}","client":"{client.ip}","proxy":"{apiproxy.name}","verb":"{request.verb}","path":"{request.path}","status":"{response.status.code}"}</Message>
    <Host>otel-collector.example.com</Host>
    <Port>5514</Port>
    <Protocol>TCP</Protocol>
    <FormatMessage>true</FormatMessage>
  </Syslog>
</MessageLogging>

otelcol.yaml

receivers:
  syslog/apigee:
    tcp:
      listen_address: 0.0.0.0:5514
    protocol: rfc5424

service:
  pipelines:
    logs:
      receivers: [syslog/apigee]
      exporters: [otlphttp/sazabi]

Set up with the CLI

sazabi log-sources create aws_api_gateway
sazabi log-sources setup-instructions aws_api_gateway

The create command prints the intake URL for the collector’s otlphttp/sazabi endpoint.

Verify

Open the Intake page in the Sazabi dashboard and confirm records from the AWS API Gateway source appear within a few minutes. From the CLI, sazabi logs ask "How many API Gateway access log lines arrived in the last 15 minutes, by status?" confirms records are arriving. Search for status 401 or 403 to find failed authorizations, or 429 to find throttled clients.

Troubleshooting

No log groups in CloudWatch — Access logging is set per stage. Check the stage’s log settings, and for execution logs, the account-level CloudWatch Logs role. Collector logs AccessDeniedException — The collector’s AWS identity is missing logs:FilterLogEvents or logs:DescribeLogGroups. Collector runs but nothing arrives — Check that your log group names start with API-Gateway- and that region matches where your APIs run.

AWS CloudWatch

Forward any CloudWatch log group to Sazabi.

OpenTelemetry Collector

Forward logs from any Collector receiver.

Intake

See per-source ingestion volume and health.

Overview

Get started

Guides

Catalogs

Reference

Security & trust

cve.now

AWS API Gateway

About

Prerequisites

Set up in the dashboard

Turn on API Gateway logging

Configure the collector

Deploy and send a request

Other API gateways

Set up with the CLI

Verify

Troubleshooting

Further reading

AWS CloudWatch

OpenTelemetry Collector

Intake

​About

​Prerequisites

​Set up in the dashboard

​Turn on API Gateway logging

​Configure the collector

​Deploy and send a request

​Other API gateways

​Set up with the CLI

​Verify

​Troubleshooting

​Further reading

AWS CloudWatch

OpenTelemetry Collector

Intake

About

Prerequisites

Set up in the dashboard

Turn on API Gateway logging

Configure the collector

Deploy and send a request

Other API gateways

Set up with the CLI

Verify

Troubleshooting

Further reading