I found logstash's Grok a good tool because it is composable and you can reuse complex expressions with simpler naming. There is also a knowledge base of good

I found logstash's Grok a good tool because it is composable and you can reuse complex expressions with simpler naming. There is also a knowledge base of good regex you can use without reinventing the wheel. Rubular.com is also a great tool for working out regex matches.