I learned by having to parse fields from log messages, in order to ingest log sources that aren't supported by the $SIEM at $job. Having said that, I typically learn regex, then forget regex, then learn regex and so on....