I'm not saying that's the best way to do it, just that it's how we did it back then. Of course there might be better ways to do it. I was in charge of exploring this way (which we didn't end up keeping, as I hint at at the end of the post), and thought it would be valuable to share what I learned with people.

Regarding your latter point, as I mentionned, a pattern fails silently if it doesn't match a log entry while parsing incoming entries. That's why Graylog requires you to load a log entry example when creating an extractor, and let you try it while defining the pattern (with the "Try" button next to the pattern input field). I didn't put enough emphasis on this feature in my post, though.