Improve Grok function docs

[philrz]

A recent community Slack thread inspired me to finish a long standing to-do to improve these Grok function docs.

If you'd like to review by seeing it rendered, I've got it on a personal staging site at:

https://66c760c8bd7394547de20d6c--spiffy-gnome-8f2834.netlify.app/docs/next/language/functions/grok

[philrz]

I know this section is long, but it's my best attempt to deal with the fact that web searches for "grok parsing" and such will reveal tons of examples that, taken unmodified, will not work in our implementation. Since we collectively don't have the cycles or stomach to build full compatibility with Logstash, I figure the next best thing is just disclose as much as we can and hope users are patient.

[mattnibs]

I think my problem with this change is it basically reads like here are the features we don't have that logstash has when docs usually read like here are the features. It also assumes that user looking at this doc is familiar with logstash's implementation of grok which probably is true but also might now be. I do think we could add example showing how to capture nested fields using nest_dotted and an example of how to do type conversion after the function is applied. I do think it would be ok to place a section called "differences from logstash" at the bottom of the docs after the examples.

[nwt]

I spoke with @mattnibs about this today. We agreed that working through his suggestions comes second to work he and I are focused on now, so we should merge this as is (and possibly revisit the suggestions later).

[philrz]

Thanks @nwt and @mattnibs! If we're lucky, some users may actually work off these docs by the time the topic next comes around and we'll have the benefit of their input as well. I'll go ahead and merge this for now.