Your query from the execute watch output does not include any timestamp, so why should this be an issue?
This query did not return anything. Maybe you need to specify logs-* or something?
GET logs/_search
{
"query": {
"match": {
"message": "Failed password"
}
}
}