Perhaps take a look at this
https://www.elastic.co/guide/en/elasticsearch/reference/current/dot-expand-processor.html
"client.ip" is not a "valid" name / json construction with respect to elasticsearch.
{"client.ip":"8.8.8.8","email.from":"user@email.com"}
valid json should look like this
{"client" : {"ip":"8.8.8.8"} ,"email" : {"from":"user@email.com"}}
the grok in regular logs is creating the correct json.
So you might need to use the dot expander I referenced above
EDIT : This can seem a bit confusing because after you create valid json you can reference a field like client.ip but that is not the correct way to create it from a json document