Yes, that's the reason why it's not working,
so in your query, you should use the "not analyzed" version of the message field, which is message.keyword, according to the mapping.
"must_not": [
{
"wildcard": {
"message.keyword": "JOIN*"
}