There are more options for your request. You can use Dynamic Watchlist for regex and you should set the ESM Strings as Source than here you go, type your regex. I can provide more different options but why you are using this watchlist? Do you want to report only the google domains or are you looking for correlation?
I have a similar issue, however I'm specifically looking to populate a source user watchlist for machine accounts. I've had the ESM string regex setup, but because run against the string table the results are giving me anything within the regex query and not just usernames. Is there a way to only tag against username data?