Help with Disabled Rule

[roman-tasi]

Hi this is my rule:

name: Audit Started Process (Discord) Rules File
type: any
filter:
- term:
    event.action: "process_started"
index: auditbeat-*
realert:
 minutes: 0
include:
 - process.args
 - user.name
 - process.working_directory
include_match_in_root: true
alert_subject: "(1} by {2} in {3}"
alert_subject_args:
 - "@timestamp"
 - process.args
 - user.name
 - process.working_directory
is_enabled: true
alert_text_type: alert_text_only
alert:
- discord:
        discord_webhook_url: "https://discordapp.com/api/webhooks/1097924976876736673/mZMpu_Ir2odNJG7R7cx71HzjiOeJ_nz703o3RbPL6pKdBxnVDboe0NSEcmUN6CWNUeuZ"
        discord_embed_footer: "auditbeat-*"
        discord_emoji_title: ":cyclone:"
_source_enabled: true

For some reason after running once it becomes disabled. Also not sure why but it appears many times in the Disabled Rules log like so:

Disabled rules are: ['Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File', 'Audit Started Process (Discord) Rules File']

Not sure if that matters or is a cause for concern.

Help is appreciated!

[roman-tasi]

Nevermind I see it now, it was the parenthesis in front of the 1