Again, you cannot use JSON log as lookup, unless you have an external system to convert these JSON events to CSV (which is not trivial and is generally ill advised because there is no industry standard to do this). Again, what is it you are really trying to achieve?  What fields in the JSON file interest you?  What do the values look like?  How do you plan to use these field names and values?  In the end, if some fields are useful as lookup, you can always ingest the file into an index, then use outputlookup to save them into lookup format. ... View more