evernote.conf

input {
    file {
        path => "<path:evernote-json-file>"
        start_position => "beginning"
        sincedb_path => "nul"
        codec => multiline {
            pattern => "job_description_id"
            negate => true
            what => "previous"
            auto_flush_interval => 1
        }    
    }
}

filter {
    #first square bracket drop
    if [message] =~ "\[\n\t{" {
        drop{}
    }

    mutate {
        #(\n\]): last square bracket
        gsub => [
            "message", "(\n\])|[\n\t]|(,\n\t{)", ""
        ]

        #update json format
        replace => {
            "message" => "{%{message}"
        }
        remove_field => ["tags", "host" ,"@version", "path", "@timestamp"]
    }

    json {
        source => "message"
        remove_field => ["message"]
    }

}

output {
    stdout{}
}