thats strange. are you sure type for the field message is keyword?
can you post your schema mapping for your index?
(how to find schema mapping for your index - https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html)