The easiest answer to search by cluster for your example hostnames would be:
For Cluster1: host="test1*"
For Cluster2: host="test2*"
For Cluster3: host="test3*"
If you're doing a lot of this over a large data set you may want to test the efficiency of the comparisons.
You will probably want to be able to do further operations such as stats or timechart by cluster, so I recommend that you create a new field for "cluster" using eval, rex, field extraction in props.conf, or by creating a custom field at index time for fastest searching.
For example, with a "rex", this takes the events from your base search and looks for the "test" pattern in the "host" field, then captures the following digit into a field named "cluster":
| rex field=host "(?i)test(?P<cluster>[\\d])"
so now you can show stats by cluster:
| rex field=host "(?i)test(?P<cluster>[\\d])" | stats count by cluster