macro.conf

# Create a Macro named logstash_log that is used in the VirtualHost
# It defines, on the fly, a macro for the specific vhost $servername
# and anchors its @source, $source_host and @source_path.
# 
    <Macro logstash_log ${servername} ${hostname}>
	   LogFormat "{ \
		   \"@source\":\"file ://${hostname}//var/log/httpd/${servername}-access_log\",\"@source_host\": \"${hostname}\", \
		   \"@source_path\": \"/var/log/httpd/${servername}-access_log\", \
		   \"@tags\":[\"${servername}\"], \
		   \"@message\": \"%h %l %u %t \\\"%r\\\" %>s %b\", \ 
		   \"@fields\": { \
			   \"timestamp\": \"%{%Y-%m-%dT%H:%M:%S%z}t\", \
			   \"clientip\": \"%a\", \
			   \"duration\": %D, \
			   \"status\": %>s, \
			   \"request\": \"%U%q\", \
			   \"urlpath\": \"%U\", \
			   \"urlquery\": \"%q\", \
			   \"method\": \"%m\", \
			   \"bytes\": %B, \ 
			   \"vhost\": \"%v\" \
		   } \
	   }" logstash_apache_json

	   CustomLog /var/log/httpd/${servername}-access_log json_event_log
	</Macro>