I have a index time transform which is a bit loose in what it matches. I would like to limit it to a whitelist of indexes that I want to match against. I would very much appreciate your help with creating a clean regular expression to achieve the goal.
So I think I want REGEX = match any event with a embedded field of the form index="SomeIndexName" where SomeIndexName in (App1,App2,App3).
My current transform