Apologies if this has been asked before.
I am using the file input with no codec specified. I'm just reading some logs. Some of the messages are json but unfortunately also contain some pre and post text wrapping the well formed json. That is not a problem as I can very easily grok out the json itself into a new field.
I can then use that field in the json filter and I get, in my output, a field with the json message.
What I need however is for that json to be split up into its component pieces similar to what I'd get if I were using the json codec in the input block.