Logstash Array of JSON

That will persist the in-memory sincedb in a file called NULL in the working directory of logstash. On Windows, if you want the sincedb reset each time logstash starts then set it to "NUL", not "NULL". (On UNIX use "/dev/null".)

It looks like your json file is pretty-printed with one key/value pair per line. You will need to combine the lines using a multiline codec (so instead of using a json codec you will need to use a json filter to parse the JSON).

You could start by reading this and this (yes, it's XML rather than JSON, but exactly the same method applies).