CloudWatch: count number of requests from cloudwatch logs and create alarm

If I understood your requirement correctly you have a log group that captures records of user logging which includes the userid field and you need to set an alarm if one or many of these userids if they reach a certain threshold within an hour.

I would suggest creating a metric filter on your log group as described here -> https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateMetricFilterProcedure.html

Then setup a cloudwatch alarm based on the metric filter you created -> https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_alarm_log_group_metric_filter.html