That is an Elasticsearch question, not about logstash, and you are more likely to get an answer if you move it to the Elasticsearch forum.
I would guess (I do not run Elasticsearch) that the fieldname has a . in it. logstash can distinguish between a field with a . in it ([client.ip]) and a field that contains another field ([client][ip]). I believe kibana and Elasticsearch use [client.ip] for both, leading to some ambiguity. I know that for a while Elasticsearch did not allow fieldnames to contain ., but that restriction was removed as the disambiguation code was improved.