you can use
lsof -p LogstashPID| wc -l
as described earlier , run with crontab, if count reach or exceed some threshold, you can alert.
if you have some monitorinfg system, like as example, zabbix, you can configure zabbix trapper and configure there some alert rules