Well, it does not work actually.
I get an exception:
2017/02/18 15:13:35.580963 client.go:432: WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse [ip]","caused_by":{"type":"illegal_argument_exception","reason":"'-' is not an IP string literal."}}
But if I change the type for ip field to keyword, I see in the imported log line:
"ip": "-",
So the value is indeed -, but for some reason script does not work.
I also tried to change null in your script to ctx.duration, just to be sure that part of code is really executed, and then I see that the value of ctx.duration is correctly assigned to ip field. So null is the root of the problem: it does not work for some reason.