I have developed Grok expression support in Beats.
You can get the code from https://github.com/ramon-garcia/beats/tree/extend-processors/ (branch extended-processors). You can see the documentation here https://github.com/ramon-garcia/beats/blob/extend-processors/libbeat/docs/processors-using.asciidoc#grok
I offered a pull request to Beats, but the development team disagrees about client side processing. The prefer everything processed in the server side.
Anyway, if you want to process your logs in the client side, you can look at my code (grok.go and grok_test.go) My experience is that writting Beats processing modules is simple. I encourage you to do so.