I got curious how to do this, so I downloaded the Groovy SDK (since Painless is very similar to Groovy) and played around with some test code in Groovy Console:
Maybe this will work for you:
def dom = doc['domain'].value;
String[] level = dom.split(/\./); // split the string per regex
List ss = Arrays.asList(level);
String l2 = ss[1]; // 1-th index is the "second" level
return l2;