As Badge mentioned, if you are using syslog plugin, there should be the logsource field together with priority, severity, host.
You can manually add source.ip base on some criteria:
if [somefield]=="value"
{
mutate { add_field => { "[source][ip]" => "192.168.1.11" }
}
If you want [source][ip] as IP field/data type in ES, then you have to create/change index template with [source][ip] as IP field type. GEO structure is optional.