Cloudwatch query to fetch first api call from a specific ip

Question

I have a logs like this

1. {"api":"/someapi1","user_ip":"0.0.0.0"}
2. {"api":"/someapi2","user_ip":"0.0.0.0"}
3. {"api":"/someapi3","user_ip":"0.0.0.0"}
4. {"api":"/someapi1","user_ip":"1.1.1.1"}
5. {"api":"/someapi2","user_ip":"1.1.1.1"}
6. {"api":"/someapi1","user_ip":"2.2.2.2"}

and I want result like this

"api":"/someapi1","user_ip":"0.0.0.0"

"api":"/someapi1","user_ip":"1.1.1.1"

"api":"/someapi1","user_ip":"2.2.2.2"

basically I want to do get the first api call been made by a particular user_ip

whatever I have achieved so far is

fields @timestamp,user_ip  
| filter @logStream="fargate/dazn-picks-svc/0dba2605473d45d09d1e8ae00aa52105"
AND ispresent(user_ip) AND isPresent(`private.dazn-picks-svc.api`) 
| display @message ,`private.dazn-picks-svc.api`,user_ip

by this we can get all api request by that particular ip