Yes, the scrubbed portion is an IP.
I discovered what I was doing wrong and will post my stupidity here in case someone else can learn from it.
I was not applying the APM-server integration to the correct policy. The policy used by the elastic server was different.