Version field type shows as unknown in the index pattern

[Dor_Dadush]

Hi everyone
I have an index template which contains a mapping of the field agent.version to the type version (introduced in 7.10.X if I'm not mistaken)

But, in the index pattern of the relevant index, I see this field as unknown type:

• I don't have any conflicts under this index pattern

• I have also validated the index mapping of this specific index:
  These are the results for GET /test-logs-2021-03-02/_mapping :

    "mappings" : {
          "properties" : {
            "@timestamp" : {
              "type" : "date"
            },
            "@version" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "agent" : {
              "properties" : {
                "ephemeral_id" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "hostname" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "id" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "name" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
                },
                "type" : {
                  "type" : "text",
                  "fields" : {
                    "keyword" : {
                      "type" : "keyword",
                      "ignore_above" : 256
                    }
                  }
            },
            "version" : {
              "type" : "version"
            }
          }
        },
    ...

I want to perform visualizations according to this field as the Version type, but now I cannot do anything with it.

Thanks in advance!

[wylie (Wylie Conlon)]

Hi, thanks for letting us know about this! We try to keep Kibana up to date with new ES data types, but it looks like we didn't here. Here is a Github issue I just opened to track the work on this.

In the meantime, I suggest that you use a workaround: copy your version into a keyword field, either by using multi-mapping or the copy_to mapping property. This will let you use it in Kibana.