Your [vpn][tunnel_type] is not a string, it is an object. So your mutate filter does not do anything. Trying to parse this object with a json filter
"tunnel_type" => {
"tunnel_id" => "1087764505",
"tunnel_type" => "ssl-tunnel",
"tunnel_ip" => "192.168.1.1"
}
gets the error message
Error parsing json {:source=>"[vpn][tunnel_type]", :raw=>{"tunnel_id"=>"1087764505", "tunnel_ip"=>"192.168.1.1", "tunnel_type"=>"ssl-tunnel"}, :exception=>java.lang.ClassCastException: ...
If it were a string then you would get the error
Error parsing json {:source=>"[vpn][tunnel_type]", :raw=>"{\"tunnel_id\"=>\"1087764505\", \"tunnel_type\"=>\"ssl-tunnel\", \"tunnel_ip\"=>\"192.168.1.1\"}", :exception=>#<LogStash::Json::ParserError: Unexpected character ('=' (code 61)): ...
If you need to move the contents of [vpn][tunnel_type] to the top level use ruby.