Back to the simpler email address check.

Author: chrisberkhout

packages/azure/data_stream/identity_protection/elasticsearch/ingest_pipeline/default.yml

@@ -225,7 +225,7 @@ processors:
   - set:
      field: user.email
      copy_from: azure.identityprotection.properties.user_principal_name
-     if: "(ctx.azure?.identityprotection?.properties?.user_principal_name ?: '') =~ /^[^@]+@[^@]+$/"
+     if: ctx.azure?.identityprotection?.properties?.user_principal_name?.contains('@') == true
   - grok:
      field: azure.identityprotection.properties.user_principal_name
      patterns:

packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml

@@ -226,7 +226,7 @@ processors:
   - set:
       field: user.email
       copy_from: azure.signinlogs.properties.user_principal_name
-      if: "(ctx.azure?.signinlogs?.properties?.user_principal_name ?: '') =~ /^[^@]+@[^@]+$/"
+      if: ctx.azure?.signinlogs?.properties?.user_principal_name?.contains('@') == true
   - grok:
       field: azure.signinlogs.properties.user_principal_name
       patterns: