Snowflake stores JSON in VARIANT columns. WEB.EVENTS.PAYLOAD holds each clickstream event as it arrived. A path reads inside it: a colon for the first key, dots after that, and brackets for array positions:
SELECT payload:event, payload:user.country, payload:items[0].sku
FROM web.events;
What comes back is still VARIANT, so text shows in double quotes: "page_view". Cast it to a real type with ::, as in payload:event::STRING or payload:items[0].qty::INT, before you group, join or compare.
Keys are case-sensitive: payload:Event is NULL. A key that's missing is NULL too, which is how optional fields behave.
Feeds aren't always consistent. In this one, order_value is sometimes a number and sometimes a string. TYPEOF(payload:order_value) shows which, and a cast like ::NUMBER(10,2) reads both.