OK, so you will have to explore more deeply your Alerts page to see if it ever goes from Normal to Pending to Firing. I found that while I would get “Alerting” on the Preview Alerts table (as you do), I was not getting the Alerts page to display “Firing”. I even posted here about it, although the answer provided was not really satisfactory.
I spent more time with this and eventually got it to work for a single parameter (not a multidimensional alert) by removing the time field (but I am using Influx, not Elasticsearch). I plan to post my solution in the coming days when I have some time to do a writeup. In the meantime, try to do a deep explore of your data and try to figure out if there could be any reason(s) for not receiving an alert, even though you received Alerting on the above screen.