It’s working for me.

I got an alert almost instantly, as I created all of the logs and metric filter with my root user. I think the main issue with the filter is that it’s not just alerting on a login, it’s alerting on basically any activity performed by the root user. My "Root User Activity" count jumped to 109 at it’s peak.