Add warning log when the number of tasks stored in memory exceeds the configured threshold.

[alexcams]

This PR introduces a new feature to log a warning when the number of tasks stored in memory exceeds the configured threshold.

Two new config parameters have been added:

• map_count_warning_threshold: The max number of tasks that can be stored in memory simultaneously before warning. The warning message will be repeated every 20% of the configured threshold.

Added Unit tests and also tested manually with following config:

input {
  generator {
    count => 10
    message => "test event"
  }
}

filter {
  ruby {
    code => "event.set('task_id', java.util.UUID.randomUUID.to_s)"
  }

  # Aggregate filter with low threshold for testing
  aggregate {
    task_id => "%{task_id}"
    code => ""
    # No end_of_task - maps accumulate forever
    map_count_warning_threshold => 5
    timeout => 3600
  }
}

output {
  stdout {
    codec => dots
  }
}

The config generates 50 task events, configuring threshold to 5 and repeating the log after every 20% of 5 (1). This should generate 5 warning logs, one every 5 events after first 5 tasks:

[2026-02-03T16:12:45,527][WARN ][logstash.filters.aggregate][main][9f2d3e17a6b9686b2905ba0fa1916354a354f5c8847f1717f279cca7dadcd94d] Aggregate filter memory warning: task_id pattern '%{task_id}' has 5 maps in memory (threshold: 5). {:task_id_pattern=>"%{task_id}", :map_count=>5, :threshold=>5}
[2026-02-03T16:12:45,527][WARN ][logstash.filters.aggregate][main][9f2d3e17a6b9686b2905ba0fa1916354a354f5c8847f1717f279cca7dadcd94d] Aggregate filter memory warning: task_id pattern '%{task_id}' has 6 maps in memory (threshold: 5). {:task_id_pattern=>"%{task_id}", :map_count=>6, :threshold=>5}
[2026-02-03T16:12:45,528][WARN ][logstash.filters.aggregate][main][9f2d3e17a6b9686b2905ba0fa1916354a354f5c8847f1717f279cca7dadcd94d] Aggregate filter memory warning: task_id pattern '%{task_id}' has 7 maps in memory (threshold: 5). {:task_id_pattern=>"%{task_id}", :map_count=>7, :threshold=>5}
[2026-02-03T16:12:45,528][WARN ][logstash.filters.aggregate][main][9f2d3e17a6b9686b2905ba0fa1916354a354f5c8847f1717f279cca7dadcd94d] Aggregate filter memory warning: task_id pattern '%{task_id}' has 8 maps in memory (threshold: 5). {:task_id_pattern=>"%{task_id}", :map_count=>8, :threshold=>5}
[2026-02-03T16:12:45,528][WARN ][logstash.filters.aggregate][main][9f2d3e17a6b9686b2905ba0fa1916354a354f5c8847f1717f279cca7dadcd94d] Aggregate filter memory warning: task_id pattern '%{task_id}' has 9 maps in memory (threshold: 5). {:task_id_pattern=>"%{task_id}", :map_count=>9, :threshold=>5}

Tested with bigger thresholds as well.

[andsel]

I've asked for some clarification on the concurrency update of the internal counter.
The PR is missing:

• update of the version in `logstash-filter-aggregate.gemspec``
• documenting the 2 config parameter introduced

[alexcams]

@andsel Thanks for the review and pointing the missing docs and version!

[andsel]

Last nitpick :-) I promise.

However given that this is a new feature and not a bugfix I would increase the minor version and not the patch one. So switch version number from 2.10.1 to 2.11.0.

[andsel]

LGTM!