UPDATED FOR 3.0.2, the final 2.0.x version is tagged 2.0
This is a collection of GROK patterns to help get going.
Currently included:
BASE10NUM BASE16FLOAT BASE16NUM CISCOMAC COMBINEDAPACHELOG COMMA COMMONAPACHELOG COMMONMAC DATA DATE DATE_EU DATE_US DATE_US2 DATESTAMP DATESTAMP_EVENTLOG DATESTAMP_OTHER DATESTAMP_RFC2822 DATESTAMP_RFC822 DAY GREEDYDATA HOST HOSTNAME HOSTPORT HOUR HTTPDATE INT IP IPORHOST IPV4 IPV6 ISO8601_TIMEZONE LOGLEVEL MAC MINUTE MONTH MONTHDAY MONTHNUM MONTHNUM2 NONNEGINT NOTCOMMA NOTSPACE NUMBER PATH POSINT PROG PROTOCOL QS QSORNC QUOTEDQUOTES QUOTEDSTRING QUOTES SECOND SPACE SYSLOGBASE SYSLOGFACILITY SYSLOGHOST SYSLOGPROG SYSLOGTIMESTAMP TIME TIMESTAMP_ISO8601 TTY TZ UNIXPATH URI URIHOST URIPARAM URIPATH URIPATHPARAM URIPROTO USER USERNAME UUID WINDNS_FLAGSCHAR WINDNS_FLAGSHEX WINDNS_IP WINDNS_OPCODE WINDNS_PROTOCOL WINDNS_QTYPE WINDNS_QUERYRESP WINDNS_RESPONSE WINDNS_SNDRCV WINDNS_THREADID WINDNS_TIME WINDOWSMAC WINPATH WORD WORDSWITHDASH YEAR