Recommendations to others considering Elastic Security:
Learn to use Grok. Find a Grok parser online and then look for a LOT of guides on how to write grok. There are plenty of them out there.
When you have found your guide, test out your code. Set up a CI / CD environment, even if it is a simple one to test out your changes to your logstash configuration files.
Make sure you setup all your inputs and outputs as separate files, it makes for a LOT easier debugs.
Use a version control system like git, it makes finding problems with your configuration changes a LOT easier
Basically what I am saying is follow the principals of DevOps, logstash is trouble Review collected by and hosted on G2.com.
What problems is Elastic Security solving and how is that benefiting you?
Analyzing windows and Linux log files for common use, and miss use of computers. Being able to see in one central location how all of the systems and clients are behaving is wonderful. Review collected by and hosted on G2.com.