Extract a substring from field

Yes, you probably want to go with ingest pipeline then
https://www.elastic.co/guide/en/elasticsearch/reference/master/grok-processor.html