Try adding to logstash pipeline following config. This should work, but there has been change in the licensing of MaxMind geoip database (which logstash uses), so if it won't work, let me know and we'll move from there.
geoip {
source => "[data][office365][ClientIP]"
}
