I agree with Dan here, a misconfiguration of your issuer seems to be the issue.
Unexpected JWT issuer: https://xxxx.ngrok.io
means that you have configured https://xxxx.ngrok.io in fusionAuth but something different in
op.issuer: "https://xxx/"
Looking at the masked value, I think this is because of the trailing / that you have in that value in the elastic stack config. issuer is most commonly a URL but the equivalence check is string matching not canonicalized url matching, so
https://xxxx.ngrok.io is not the same as https://xxxx.ngrok.io/
FWIW, this is not peculiarity of "some systems" but a very well defined requirement of the OpenID Connect specification.