Grok add_field from another field

Elastic Stack Logstash
1

I have a field "host" that looks like this:
"aaa-b1.site.com"
I want to add a new field "env" containing only "b1". My filter:

grok {
match => {
"message" => "url:%{DATA:host}"
}
add_field => { "env" => ".*%{DATA:env}\.site\.com" }

How can I get a new field out of an existing field?

2

To extract the "b1" from host you could use

grok { match => { "host" => "%{WORD}-%{WORD:env}.site.com" } }