We should add an api to the ingest plugin that allows to provide a log line and get back what the corresponding grok pattern would look like. This would make dealing with grok expressions much easier.