If you don't create a mapping for your fields Elasticsearch will create the mapping the first time it index a field, when doing this it will try to guess what is the data type for that field based in its value.
Tha mapping you having means that Elasticsearch mapped that field as a string and when doing this it will map the field first as a text field and then map it also as a keyword, using the fields object to create a field with the suffix .keyword.
So, in your case you have a field named ip which is mapped a text field and a field named ip.keyword mapped as a keyword field.