And Logstash didn't crash with this configuration? I don't know where you got that, but that kind of syntax and functionality doesn't exist. You could follow this example: How to check client_ip ipv4 or ipv6? - #3 by Badger (Additionally you should maybe check that the field isn't an empty string.)
And it's tag_on_exception, not tag_on_expection. But that only changes the tag, it doesnt suppress the error message.
(And just one more comment: You can shorten your IP with just one line of code: in ruby how to remove the last part of ip address - Stack Overflow)