title: Looking for a better way to count the 5 minute request rate of an API
body: <p>I'm trying to use AWS CloudWatch Logs Insights to count the number of requests coming from each IP address within 5 minutes of an API.</p>
  <p>Here's an example of the data I want to get.</p>
  <p>Time Range: 01:05 - 01:10</p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>Request Source</th>
  <th>Number of Requests</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>53.240.51.81</td>
  <td>314</td>
  </tr>
  <tr>
  <td>36.241.227.134</td>
  <td>237</td>
  </tr>
  <tr>
  <td>201.72.45.51</td>
  <td>201</td>
  </tr>
  </tbody>
  </table>
  </div>
  <p>Time Range: 01:10 - 01:15</p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>Request Source</th>
  <th>Number of Requests</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>43.142.151.81</td>
  <td>334</td>
  </tr>
  <tr>
  <td>36.131.237.174</td>
  <td>230</td>
  </tr>
  <tr>
  <td>161.72.15.52</td>
  <td>198</td>
  </tr>
  </tbody>
  </table>
  </div>
  <p>Time Range: 01:15 - 01:20</p>
  <div class="s-table-container">
  <table class="s-table">
  <thead>
  <tr>
  <th>Request Source</th>
  <th>Number of Requests</th>
  </tr>
  </thead>
  <tbody>
  <tr>
  <td>31.132.141.91</td>
  <td>334</td>
  </tr>
  <tr>
  <td>39.138.217.174</td>
  <td>230</td>
  </tr>
  <tr>
  <td>191.76.15.42</td>
  <td>198</td>
  </tr>
  </tbody>
  </table>
  </div>
  <p>...</p>
  <p>And here's my query:</p>
  <pre><code>fields @timestamp, @message 
  | filter (@message like &quot;/my_api&quot;) 
  | parse @message '* - * [*] * * * &quot;*&quot; * * * &quot;*&quot; &quot;*&quot; &quot;*&quot;' as remote_addr, remote_user, time_local, http_method, path, http_version, header, status_code, request_length, body_bytes_sent, http_referer, http_user_agent, http_x_forwarded_for
  | stats count() as requestCount by http_x_forwarded_for 
  | sort requestCount desc
  </code></pre>
  <p>The problem of the query above is that it only counts the number of requests within the time range I specified.</p>
  <p>So if I want to get the data during the past 24 hours, I'll have to specify the time range of Logs Insights for <code>24 * 60 / 5</code> = <code>288</code> times. And run the query for 288 times.</p>
  <p>It would be very time-consuming to do the steps I describe above.</p>
  <p>The reason I want to get the data is that I want to use AWS WAF to set a rate limit on my API.</p>
  <p>Before I apply the rate limit, I need to know the request rate of my API during normal days.</p>