It turns out the reason must have been somewhere else, at some point it suddenly worked as expected. So the fact of the matter seems to be that the colon needs to get escaped in Kibana (which is annoying), but not in the mappings file or in the actual ES requests.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.