With Version 7.2 elasticsearch it seems regex not working

[sparkingdark]

I have elasticsearch and logstash for log management and index. The current version of elasticsearch is 7.2 and same for logstash . But whenever I pass a regex to catch exception or error of python docker container it does not catch and send a email.

My config is like this:

# Rule name
name: Alert on any error
# Fill in USERNAME and PASSWORD here
es_host: "ip of server"
es_port: 9200
es_username: fdfic
es_password: heloo

# Elasticsearch Index to search for issues. As we are using
# filebeat for our log file delivery to Elasticsearch, all logs 
# will be in indices called filebeat-something.
index: filebeat*
# (Required)
# Rule name, must be unique

# (Required)
# Type of alert.
# the frequency rule type alerts when num_events events occur with timeframe time
type: frequency

# (Required)
# Index to search, wildcard supported

# (Required, frequency specific)
# Alert when this many documents matching the query occur within a timeframe
num_events: 1

# (Required, frequency specific)
# num_events must occur within this amount of time to trigger an alert
timeframe:
  minutes: 1

# (Required)
# A list of Elasticsearch filters used for find events
# These filters are joined with AND and nested in a filtered query
# For more info: http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/query-dsl.html
filter:
- query:
    query_string:
      query: "message:\"Exception\" OR message:\"Traceback\""
- terms:
    message: ["Keyerror","ConnectionError"]
- query:
    wildcard:
      message: "*Error"
# - query:
#     regexp:
#       message.raw: ".*Error"

       


# Send out the alert via email.
alert:
  - email
# Use the container name as the email subject
# alert_subject_args:
#   - docker.container.name
# alert_subject:
#   - "Error on {0}"
# Recipient address for alert emails
email_format: html
email:
- "[email protected]"      
alert_subject: "{1} WARINING - ERROR detected value to match at {0}."
alert_subject_args:
- "@timestamp"
- container.name
- container.image.name

alert_text: "<h3>Error Alert</h3><p>Error message</p>"
# For email delivery, we need to define an SMTP connection. Enter
# your SMTP host name, port and whether TLS/SSL is to be used
# (if not, it'll fall back to STARTSSL).
# We define the SMTP user data in smtp-auth.yml.
smtp_host: "smtp.gmail.com"
smtp_port: 465
smtp_ssl: true
from_addr: "[email protected]"
smtp_auth_file: "/opt/elastalert/smtp-auth.yml"

my wild card regex is also not working so can anybody help regarding this ?
I am trying to detect python exceptions. the exception are detect like in this way:

 message | KeyError: 'userid'
-- | --
  | t stream | stderr
  | suricata.eve.timestamp | Feb 23, 2023 @ 18:19:24.791

[jertel]

.raw field suffixes are from earlier versions of Elasticsearch. Version 7.x uses .keyword if I recall correctly.

[sparkingdark]

So it can be message.keyword instead of message.raw.