Using bucket aggregation on IPs not giving expected results

I think your field ipAddress is actually mapped as a type text rather than as type ip. You could check that by retrieving the mapping:

GET hostaddressindex/client/_mapping

I think you will see "type": "text" instead of "type": "ip" for the ipAddress field.

You will have to change your mapping such that ipAddress is mapped as type ip. Note that you cannot change the mapping (including the type) of an existing field. What you need to do if you want to change the mapping of existing documents is reindex those documents to another index with the updated mapping.

So, first create a new index, which you create with the new mapping. Then use the reindex API to get all documents from the old index A into the new index B. As those documents get reindexed, they will get the updated mapping applied to them. More info about the reindex API here: https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html