Thanks for getting through this.
I was able to reproduce it, the difference between using the field and using the script seems to be the way transform handles the key:
For the script it looks like this:
"entity_id" : "1396-11-28T05:38:02.565Z"
while taking the field
"entity_id" : -18084968517435
I think terms on a date should use the string value, I will create an issue for that.
I tested the suggested manual mapping (for the field based group_by) and it worked at least with the demo data. The failure you posted is about a query problem, but the mapping only affects indexing. This might be a different problem. I have a suspicion regarding this, might be an issue in composite aggregations (used internally by transform) according to the error message. I will investigate this further and come back with more info.