JSON Parsing Issue

Elastic Stack Logstash
2

Your [vpn][tunnel_type] is not a string, it is an object. So your mutate filter does not do anything. Trying to parse this object with a json filter

    "tunnel_type" => {
          "tunnel_id" => "1087764505",
        "tunnel_type" => "ssl-tunnel",
          "tunnel_ip" => "192.168.1.1"
    }

gets the error message

 Error parsing json {:source=>"[vpn][tunnel_type]", :raw=>{"tunnel_id"=>"1087764505", "tunnel_ip"=>"192.168.1.1", "tunnel_type"=>"ssl-tunnel"}, :exception=>java.lang.ClassCastException: ...

If it were a string then you would get the error

Error parsing json {:source=>"[vpn][tunnel_type]", :raw=>"{\"tunnel_id\"=>\"1087764505\", \"tunnel_type\"=>\"ssl-tunnel\", \"tunnel_ip\"=>\"192.168.1.1\"}", :exception=>#<LogStash::Json::ParserError: Unexpected character ('=' (code 61)): ...

If you need to move the contents of [vpn][tunnel_type] to the top level use ruby.