Hi @kristoflarcher,
I believe this is because the regex applies to the generated label from .es(...) and doesn't apply to the data returned. In your scenario, the regex extracts from q:msg: "Detected server" AND msg: "started" > count.
A more detailed explanation can be found here: Timelion: how generate .label() dynamically?.