Your regex would work with another field, but the message field is quite different, it is a different OpenSearch analyzer, so the field is not parsed like others.
It is not a regex but I think you can try:
message:"Starting TLS server on port"
Your regex would work with another field, but the message field is quite different, it is a different OpenSearch analyzer, so the field is not parsed like others.
It is not a regex but I think you can try:
message:"Starting TLS server on port"