For FORMAT , it should reference the number of the capture group in your regular expression (i.e., which set of parentheses are you looking in). You only need WRITE_META for index-time field extractions, which are usually best avoided. Similarly, you can just use host here in SOURCE_KEY, since it will be a normal field at that point. Last, for your regex - either use .* to match multiple characters, or just leave it out completely since you're already matching anywhere within the hostname.
Try:
#transforms.conf
[role]
SOURCE_KEY=host
REGEX=(App|Web|Doc)
FORMAT=role::$1
#props.conf:
[sourceone]
TRANSFORMS-role=role
... View more