filter-70-client.conf

filter {
  if [client][address] =~ /^\d/ {
    if ![client][ip] {
      mutate {
        add_field => {
          "[client][ip]" => "%{[client][address]}"
        }
      }
    }
  } else if [client][address] =~ /^\D/ {
    if ![client][domain] {
      mutate {
        add_field => {
          "[client][domain]" => "%{[client][address]}"
        }
      }
    }
  }
}