Using "message" in custom alert rule

@pcosic that is correct. I updated the version of filebeat. If anyone else runs into this issue they should note Breaking changes in 7.0 | Beats Platform Reference [7.13] | Elastic.