Answer (1)

You are getting a single '{' because im_file treats each line in the input as a separate event - i.e. that's what InputType LineBased is.

You need to use xm_multiline to read and concatenate the indented json into a single event record, this can be done similarly to the xml parsing example with something like this:


<Extension multiline>
    Module	xm_multiline
    HeaderLine	/^{/
    EndLine	/^}/
</Extension>

Make sure to change InputType so that this is used.