When using the JSON filter either move the parsed JSON to root or define a new root level field, seems to create issues when you attempt to overwrite the source field. This should solve your "Can't get text on a START_OBJECT at 1:115" issue. To resolve your Cast exception only execute the filter once on the field.
/usr/share/logstash/bin/logstash -e 'input {stdin{}} filter{json {source => "message" }} output{stdout {codec => rubydebug}}'
{
"@version" => "1",
"debug_thread" => "ScalaTest",
"debug_file" => "Audit1.scala",
"debug_line" => "27",
"host" => "cernccwes15.cernerasp.com",
"debug_timestamp" => "2018-12-21 05:15:57,559",
"debug_level" => "ERROR",
"debug_message" => {
"JobStartTime" => "2018-12-22",
"JobEndTime" => "2018-12-22"
},
"message" => "{\"debug_level\":\"ERROR\",\"debug_timestamp\":\"2018-12-21 05:15:57,559\",\"debug_thread\":\"ScalaTest\",\"debug_file\":\"Audit1.scala\", \"debug_line\":\"27\",\"debug_message\":{\"JobEndTime\":\"2018-12-22\",\"JobStartTime\":\"2018-12-22\"}}",
"@timestamp" => 2018-12-24T17:34:13.803Z
}
The View in Kibana:
