Hi @Adriann
seems like that field is not mapped as ip, but was mapped as text and by default also as keyword, could you please check the mappings of the source.ip and compare it to the one from the destination.ip?
GET your_index_name/_mapping/field/source.ip
GET your_index_name/_mapping/field/destination.ip