Learn to use Grok. Find a Grok parser online and then look for a LOT of guides on how to write grok. There are plenty of them out there.
When you have found your guide, test out your code. Set up a CI / CD environment, even if it is a simple one to test out your changes to your logstash configuration files.
Make sure you setup all your inputs and outputs as separate files, it makes for a LOT easier debugs.
Use a version control system like git, it makes finding problems with your configuration changes a LOT easier
Basically what I am saying is follow the principals of DevOps, logstash is trouble