# Identifying number of logs per 5 minutes, over a week? **URL:** \ **Category:** Kibana\ **Created:** [January 23, 2025, 2:50pm UTC](https://discuss.elastic.co/t/identifying-number-of-logs-per-5-minutes-over-a-week/373586 "2025-01-23T14:50:34Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![user-27022024](https://avatars.discourse-cdn.com/v4/letter/u/ce7236/32.png) [@user-27022024](https://discuss.elastic.co/u/user-27022024)\ **Post date:** [January 23, 2025, 2:50pm UTC](https://discuss.elastic.co/t/identifying-number-of-logs-per-5-minutes-over-a-week/373586/1 "2025-01-23T14:50:34Z")
We ship AWS ALB logs to Kibana. Each log has a lot of key value fields but the two we are interested in are `client_ip` and `timestamp`. For example: `timestamp: Jan 23, 2025 @ 14:40:00.268` `client_ip: 8.8.8.8` I am trying to work out the maximum number of API requests over a period of 5 minutes for an individual IP address. I can go to `Visualize` -\> `Create Visualization` -\> `Data Table` -\> Select the saved search Then `Bucket` -\> `Split rows` -\> `Aggregation: Terms` -\> `Field: client_ip`. I can then change the time frame, to 5 minutes, 60 minutes, between two timestamps etc to get the total per individual IP within this time frame. Ideally I would like to search the last 7 days of logs, and find the maximum requests per 5 minutes per ip. Is this possible? ---
**Author:** ![Marco\_Liberati](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marco_liberati/32/82953_2.png) [@Marco\_Liberati](https://discuss.elastic.co/u/Marco_Liberati)\ **Post date:** [January 24, 2025, 2:28pm UTC](https://discuss.elastic.co/t/identifying-number-of-logs-per-5-minutes-over-a-week/373586/2 "2025-01-24T14:28:28Z")
Hi @user-27022024 You need to build an ES|QL chart for this kind of things (with the limit of 10000 rows per table) as regular charts will be bound to the number of buckets generated (5 minutes bucket in 7 days is about 3300+ rows per each IP potentially...). A query like this could help: ```auto FROM your_index | STATS count = count() by BUCKET(@timestamp, 5 minutes), clientip ``` Here's an example: ![Screenshot 2025-01-24 at 15.28.15](https://us1.discourse-cdn.com/elastic/original/3X/0/3/03908c4d7d75804a8d3be51df7c22477b7466bad.png) ---
**Author:** ![RainTown](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raintown/32/140206_2.png) [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Post date:** [January 24, 2025, 5:51pm UTC](https://discuss.elastic.co/t/identifying-number-of-logs-per-5-minutes-over-a-week/373586/3 "2025-01-24T17:51:29Z")
@user-27022024 Maybe just me, but I find the query a bit ambiguous. > [@user-27022024](#): > > Ideally I would like to search the last 7 days of logs, and find the maximum requests per 5 minutes per ip. So, my interpretation here was, for every IP that made 1+ requests over last 7 days, you want to know, for every IP, what was the most "active" 5 minute slot, and how active was it (in #requests) So you would have a table with #uniq\_count(clientip) rows, and 3 columns: 1. IP 2. timestamp (effectively a 5 minute bucket) 3. the number of requests in that 5 minute bucket for that specific IP BUT, I also see the text could be interpreted differently. Can you confirm/clarify? ---
**Author:** ![user-27022024](https://avatars.discourse-cdn.com/v4/letter/u/ce7236/32.png) [@user-27022024](https://discuss.elastic.co/u/user-27022024)\ **Post date:** [January 27, 2025, 12:42pm UTC](https://discuss.elastic.co/t/identifying-number-of-logs-per-5-minutes-over-a-week/373586/4 "2025-01-27T12:42:01Z")
That is correct, I'm looking to get a baseline of how many requests each IP is making over 5 minute periods. The end goal is to have a rate limit. But to do this, I need to work out the current request pattern