Unfortunately, using of the masks in search significantly affect the DPI performance, so instead doing so we suggest to use the following solution:

1. configure clickstream recording to the file containint host option (host name) - see the http metadata recording item
2. to output the third-level domains use the following command:

grep yandex.ru clicksteam.txt|sort -uniq

as a result, a list of 3rd level domains used by subscribers of your network will be obtained.