Within Integrated Cyber Defense exchange (ICDx), the ICDx forwarder for json does not monitor for disk usage in realtime.
The recommendation is that any JSON files exported via a JSON forwarder should be consumed by the recipent. More information is available in the Administration Guide for ICDx (1.3.1 and later).