Interesting, looks like message.keyword isn't available on your index mapping. From the index pattern name it looks like you're using Filebeat. Can you share the index mapping and filebeat config?
I did find another related thread, albeit old, that suggests reindexing which could be worth a try.