Consider a scenario where you are tasked with extracting data from a directory of JSON files located at /data/logs. Each file contains log entries with fields timestamp, user_id, and action. Your goal is to create a DataFrame that includes only the entries where the action field is 'login'. Which of the following code snippets is NOT correct for this task?