The grok syntax for tail. Configuration. grok_patterns = ['%{TIMESTAMP_ISO8601:access_time}\s*%{HOSTNAME:hostname}\s*%{DATA:work}\s*%{LOGLEVEL:level}\s*(?(.)(?<=execute error)/?)\s%{GREEDYDATA:message_data}'] invalid or unsupported Perl syntax: (?<