Extract subdomain from referrer in logstash

[Med (Search)]

I use logstash to send apache log to elasticsearch. In the file config of logstash I have a filter
grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}

In the list of fields of the obtained data I have the field "referrer" of which I would like to extract the subdomain. If for example:
referrer = "http://mysubdomain.mydomain.com/controller/action"
then i need to extract the string "mysubdomain" and assign it to a new "subdomain" field.

[Badger]

Use grok and match against

"https?://(?<subdomain>[^/]+)\.[^\./]+\.[^\./]+/"

Updated to name subdomain instead of domain.

[Med (Search)]

I'm new to logstash. If you can tell me how to complete my grok it will be nice of you
grok {
match => { "message" => "%{COMBINEDAPACHELOG}"}
}
grok {
match => ???
}

[Badger]

grok { match => [ "referrer", "https?://(?<subdomain>[^/]+)\.[^\./]+\.[^\./]+/" ] }

should do it.

[Med (Search)]

Don't works for me. The referrer is variable:
referrer = "http://mysubdomain.mydomain.com/controller/action"
referrer = "http://mysubdomain.mydomain.com/controller/action/param..."
referrer = "http://mysubdomain.mydomain.com"
And I can have https or http.

[Badger]

It already handles https. If the trailing / is optional then use

grok { match => [ "referrer", "https?://(?<subdomain>[^/]+)\.[^\./]+\.[^\./]+(/|$)" ] }

[Med (Search)]

It works. Thanks