Thank you,warkolm.
Although I can't find .raw file and have not fix this issue,because the indices using bulk api and import from another application,bypass Logstash.
But I know if I can change mapping index to not_analyzed when bulk api not auto mapping. After "agg" the IPv6 format will display correctly.
Final stats > NOT FIX!
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.