sorry, I misread your scripting. The issue here is that you cannot use mustache within painless.
You need to do something like this in a painless script to concatenate strings (or you are using mustache again to create strings and only painless to provide the proper data structures).
"script": "def payload = ctx.payload; payload.msg = 'Watcher Notification Encountered ' + ctx.payload.hits.total + ' failed logon from user ' + ctx.payload.hits.hits[0]._source.winlog.event_data.TargetUserName+ '.'; return payload;"