EQL doesn't support version type fields e.g. sequence by agent.version where agent.version is of type version fails with
verification_exception: Found 1 problem\nline 2:38: Cannot use field [agent.version] with unsupported type [version]
The version field type was introduced in 7.10 #59773
