What practical experience do you have in creating and configuring Grok patterns for the ELK system?

In my practice, I have created and configured Grok patterns for parsing logs in the ELK system (Elasticsearch, Logstash, Kibana). I usually start by analyzing the log format, identifying key fields (such as timestamp, log level, message), and selecting or creating appropriate Grok patterns.

For example, for a log like

2024-06-01 12:34:56 ERROR [main] com.example.MyClass - Connection error

I used the pattern:

%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} \[%{DATA:thread}\] %{JAVACLASS:class} - %{GREEDYDATA:message}

I also configured filters for processing non-standard formats, created custom patterns when standard ones were insufficient. An important step was testing the patterns using Kibana or the built-in grok debugger to ensure correct field extraction.