It is sourcetype , not source_type . It is inputs.conf , not input.conf . It is _json , not _Json . You should NEVER use _json as your sourcetype ; make up your own appropriate to your data and add KV_MODE = json to your props.conf on your Search Head to get all the "fee" JSON field extractions . ... View more