Elasticsearch expects the “remote_addr” field to be a numeric value and not an IP address or a string.
You could create a pipeline rule which ensures that the “remote_addr” field has always the same datatype and create a custom Elasticsearch index mapping: