Regular expression format in user_alert.conf

I'm trying to use iCall and an event from user_alert.conf to fail over a BIG-IP VE cluster if an arbitrary BGP neighbor goes down. I have the handler and script working just fine if the event only looks in my logs for a static phrase, but when I have it look for a regex instead, it no longer works. However, if I test in a tool like regex101 with my expression and a log entry, it matches just fine.

Here's my user_alert.conf (sanitized of course)

alert bgp_neighbor_down "neighbor 100.200.[0-9]{1,3}.[0-9]{1,3} Down" {
        exec command="tmsh generate sys icall event neighbordown context { { name protocol value bgp } }"
}

And one of the logs I'm trying to match on:

2024/06/20 15:04:32 informational: BGP : %BGP-5-ADJCHANGE: neighbor 100.200.30.4 Down BGP Notification CEASE

If I then run imish and shut down a neighbor that should match that regex, the device I'm on stays active.

Any thoughts on what else I can try?